[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20180926020043.GB1759@dunkel.dev1ce.com>
Date: Tue, 25 Sep 2018 22:00:43 -0400
From: John Roman <john@...1ce.com>
To: passwdqc-users@...ts.openwall.com
Subject: pwqgen vs diceware
Greetings passwdqc mailing list,
I'm certainly not here to start a flame war, but I had wondered casually
which would be most suitable for a user generating a password: pwqgen,
or diceware?
what is the random dictionary used for pwqgen? are they similar?
as pwqgen generated phrases increase in size, so to do they increase in
difficulty to remember. this difficulty is bolstered by the strength
imparted by pwqgens random inclusion of case, numerics, and specials.
diceware offers high entropy passphrases at a low entry cost for the
user, but is a shorter 3 word pwqgen passphrase just as strong as a
longer 6 word passphrase from diceware? entropically they seem
identical.
pwqgwen offers greater possibility of acceptance from legacy password
systems that take fewer than 30 characters, but increases the potential
that a character might be suspect or unsupported. Diceware in turn can
be adulterated with a case, numeric, or special as needed, but might see
length issues.
pwqgen states its capable of
24-85 for entropy. diceware seems to appreciate ~77 bits of entropy.
ive been testing entropy from this page:
http://rumkin.com/tools/password/passchk.php
and here:
https://www.rempe.us/diceware/#eff
its worth noting rumkins calculation for entropy seems a little high...a
77 bit entropy phrase at diceware will yield a 200 entropy phrase, for
example...I wonder too what the appropriate entropy calculation is?
thanks for your help.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
