[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <15B799B2-9846-4C36-B7E0-4BE4F0746EB4@goldmark.org>
Date: Tue, 11 Sep 2012 13:27:49 -0500
From: Jeffrey Goldberg <jeffrey@...dmark.org>
To: john-users@...ts.openwall.com
Subject: Re: Passphrase Creation
On 2012-09-11, at 12:28 PM, Matt Weir <cweir@...edu> wrote:
> So I figured I'd outline a couple of passphrase cracking strategies
> along with some rambling thoughts:
>
> Name: Dumbforce
> Description: Like a bruteforce attack but instead of bruteforcing
> letters, use words instead. For example, using the diceware dictionary
> and trying all possible 3/4 letter combinations
You are aware that there are 7776 diceware words. I don't know what c/s rate you are imagining, but diceware with 4 words has an entropy of 51 bits.
> Target PW creation strategy: Very short passphrases and "random"
> passphrases along the lines of "correct horse battery staple"
That example drew from an (implied) list of 2048 words. So we get 44 bits of entropy for those passwords. Again, if people followed instructions and picked words truly at random, then I don't see a realistic attack here.
> Name: Mad Libs
> Description: Remember those Mad Libs books where you had to fill in
> blanks, such as "Proper-noun verbs a noun",
[big snip]
> Name: Context Free Grammars
> Description: It doesn't have to be a CFG, but a PCFG would be the type
> of grammar I'd try starting out.
You can use a CFG for both the Mad Libs and the CFG generation. Just block recursion in the first case. Really the regular language you get with the Mad Libs scheme is a simple proper subset of the CFG stuff.
But maybe it does make more sense to implement these separately.
The big problem we face is that that pass phrases are extremely rare (at least leaked ones). So we have very little data of what people actually do to go on.
But remember, diceware-like schemes are designed to withstand attacks even when the attacker knows precisely what password creation scheme was used.
Cheers,
-j
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
