10

There are a numerous passprase generators out there, but all (I have found) use English words to build the passphrase. I'd rather use German words, so I wrote a generator in Python that selects words from a large list of German words. I wonder if these passphrases can be considered strong (enough).

The word list is based on the dictonary found here https://sourceforge.net/projects/germandict/. It is described to be A free word list of contemporary German, for spell-checking and other purposes, and it contains "over 2 million entries (including inflected forms)". The list starts with:

Aachen
Aachener
Aachenerin
Aachenerinnen
Aachenern
Aacheners
Aachenfahrt
Aachenfahrten
Aachenreise
Aachenreisen
Aachens
Aadorf
Aadorfs
Aal
aalaehnlich
aalaehnliche
aalaehnlichem
aalaehnlichen
aalaehnlicher
aalaehnliches

The list is sorted alphabetically. In the original list, the words contain Umlauts (ä, ö, ü, etc.), which I replaced with the corresponding two-character string (ae, oe, ue, etc.).

The code loads the complete 2+ million lines into memory, then selects words using Python's secrets.choice() function to randomly select a number of words from the list to build a passhrase.

The Python doc describes the secrets module as "The secrets module is used for generating cryptographically strong random numbers suitable for managing data such as passwords, account authentication, security tokens, and related secrets." (see https://docs.python.org/3/library/secrets.html. The secrets.choice(sequence) function does "Return a randomly chosen element from a non-empty sequence."

Before generating a passphrase, the code asks the user for the number of words it shall be composed of, and also the minimum and maximum length of the words. It uses secrets.choice(sequence) repeatedly, until the number of words in the desired length are found. The words are then concatenated with a dash ("-") to form the passphrase. (I did not include the complete code, since this is not a coding forum. Will do so, if requested)

Is this process appropriate to generate strong passhprases?

Improve this question
6
  • Where is the password generator supposed to be used? If it is used in a German speaking context using German words seems like the obvious choice and hence provides very little benefit. On the other hand, for someone who doesn't speak German, memorizing a bunch of German words could be almost as difficult as memorizing a random letter sequence.
    – quarague
    Commented Jul 23 at 8:06
  • 16
    I pity whoever gets Abendmahlsgemeinschaftserklaerungen-Abfallbehandlungspflichtenverordnung-Genehmigungsinhaberinnen-Seitenbeschreibungssprachen-Landespersonalvertretungsgesetzen
    – jcaron
    Commented Jul 23 at 10:02
  • 1
    @jcaron that's 4-4-2-3-4 words in each compound word respectively, making it a whopping 17 word password. Perhaps using German for diceroll wordlists isn't that great of an idea :p
    – ave
    Commented Jul 24 at 13:20
  • 1
    Obligatory XKCD: xkcd.com/936/?correct=horse&battery=staple
    – Clockwork
    Commented Jul 24 at 14:25
  • 1
    @Clockwork Boo, I was hoping the query parameters would have a special effect.
    – Karl Knechtel
    Commented Jul 24 at 16:07

4 Answers 4

Reset to default
19

"2 million entries ..." - which is about 21 bit. So you basically ask if a passphrase build from a multiple of 21 bit randomness per word could be secure. The actual language of the words does not matter at all here.

So when using a passphrase of 6 random words from this dictionary one would achieve 126 bits, which is considered very strong. This assumes though that the user will not regenerate passphrases again and again until they get one which they think they can remember better. Because a passphrase randomly generated from a huge dictionary is not necessarily better to remember than a similar strong random password, so users might just trick your idea to get better usability.

Apart from that there is no universal meaning of "strong", but it depends on the context. The range of more or less 128 bit is strong enough to protect against high speed brute-forcing. But if the attackers speed could be reduced, then it is also fine to use less strong passwords, i.e. even a short pin number can be strong enough if the account is simply locked after 3 failed attempts.

Improve this answer
6
  • 5
    "Assuming that the user will not regenerate passphrases again and again" - generate 16 passphrases, pick the one you can remember best, and you still have N-4 bits of entropy I suppose?
    – Bergi
    Commented Jul 22 at 18:10
  • Worth noting that you can't compare bits of entropy given a known scheme with bits of entropy without a known scheme. If an attacker is doing a high speed brute force attack he will not be using a german dictionary file. Put differently: The knowledge of the scheme is a part of the password and increases the entropy of the password.
    – David Mulder
    Commented Jul 22 at 18:20
  • 12
    @DavidMulder: In cryptography it is typically assumed that the algorithm is known but not the key. In case of a scheme for choosing a passphrase I think it should better be assumed that the passphrase scheme including the dictionary (i.e. the algorithm) is known and only the actually generated random passphrase (the key) is not.
    – Steffen Ullrich
    Commented Jul 22 at 19:11
  • 1
    @DavidMulder a brute force attacker doesn't need to know how you generated a password. That's what "brute force" means. We don't assume they know the algorithm because we think they actually do, we assume they know the algorithm because in most cases the algorithm is irrelevant or easily guessed. The other reason to make that assumption is that even very smart people like software engineers basically always have poor intuitions around what is "secure".
    – Jared Smith
    Commented Jul 23 at 11:50
  • 1
    @DavidMulder: "Keeping the scheme secret is trivial without basically any downsides." - this might be true for some scheme one is developing in private and never publishes and where one can be sure that nobody would think of the same scheme. But, it's common to use something somebody else has developed or follow some common rules - in which case the attacker can include the knowledge of common password schemes for speeding up brute force. That's why I would better consider the scheme more or less known when evaluating the security.
    – Steffen Ullrich
    Commented Jul 23 at 13:38
13

Your 2-million word list is long, which is good for entropy, but potentially bad for memorability. Such a long list is bound to have:

  • many forms of the same word with small variations, which can be confusing (was it "guess", "guessing" or "guessed"?)
  • uncommon words, which may be difficult to remember themselves;
  • long words, especially when German is a language known for run-on words, which may make your passphrase excessively long.

If possible, consider using a curated word list that contains shorter, common, distinct words.

For reference, here's EFF's thoughts on usability of a word list: https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases

We based our list off of data collected by Ghent University's Center for Reading Research. [...] This list gives us a good idea of which words are most likely to be familiar to English speakers and eliminates most of the unusual words [...]

We took all words between 3 and 9 characters from the list, prioritizing the most recognized words and then the most concrete words. We manually checked and attempted to remove as many profane, insulting, sensitive, or emotionally-charged words as possible, and also filtered based on several public lists of vulgar English words [...]. We further removed words which are difficult to spell as well as homophones (which might be confused during recall). We also ensured that no word is an exact prefix of any other word.

Improve this answer
4
  • Good point. This would be the equivalent of the exclude-lookalike-characters feature in KeePass where you avoid having a lowercase L or an uppercase i in your password.
    – Ja1024
    Commented Jul 22 at 9:13
  • I understans your point. However, I'm using a password app, so I don't have to remember. The main goal of the code is to create long passwords, which are not too cryptic to type in. I sometimes need to tell a passphrase to someone else, and it is less error prone if it consists of words.
    – phunsoft
    Commented Jul 23 at 8:53
  • 1
    @phunsoft Even when you don't need to actually memorize the password, these points still apply. For example, an excessively long password may exceed the length limit of the service, forcing you to use a password consisting of fewer words. When you need to verbally tell someone else the password, having shorter, distinct, common words helps reduce transcription error. German as a language does not have homophones IIUC, but having different forms of the same word is still confusing.
    – twisteroid ambassador
    Commented Jul 23 at 9:01
  • For what it's worth, German diceware lists exist, such as this one that seems fine (but I have no experience with). Each word is 10 letters or fewer, and at 7776 words (6^56, 12.9 bits each) you can still get thousands of years worth of keyspace entropy within six words.
    – Jeff Bowman
    Commented Jul 24 at 16:17
8

The approach is generally sound - you're picking random words from a large list using a cryptographically secure function. However I would suggest that it may be good to filter out very short words by default, or at least warn the user if they choose not to do so.

Because a quick look at the list shows that it contains a some two-character words - so if you pick three random words from it you could end up with a passphrase such as AA-Ab-ad - or AA-AA-AA if you're not checking to prevent duplicate words.

And while those passwords would be hard for an attacker to crack based on them picking three random words out of your list, they may be susceptible to brute-force attacks due to the short length.

If you filtered repeated words, and also (for instance) any words that less than five characters long then you'd guarantee than any three-word passphrase would be at least 17 characters long, which is more than enough to resist brute-force attacks (and also forces Windows not to store LM hashes in memory, which may be a consideration), while making almost no difference to the size of the wordlist.

Improve this answer
5
  • 1
    I didn't mention but currently the code request for minimum length to be >=3. Based on your answer, I have changed it to be >=5. And I'll add a check to avoid duplicates, however unlikely they are based on the randomness of the selection.
    – phunsoft
    Commented Jul 22 at 7:43
  • Sounds good....
    – Gh0stFish
    Commented Jul 22 at 8:25
  • 1
    The chance of picking a passphrase consisting of three very short words is negligible. Because it is negligible, adding a check to reject such passphrases (and generate a new one instead) is also harmless. However, removing short words entirely from the word list also disallows passphrases containing just one short word, which will reduce the entropy of the generated phrases (while also making them longer — and thus harder to type and memorize — on average). […]
    – Ilmari Karonen
    Commented Jul 22 at 18:18
  • 1
    […] That's not to say that pruning the word list is necessarily harmful (as it can improve memorizability and thus allow longer passphrases), but I wouldn't start by pruning short words. Pruning very long or uncommon words as well as homophones of common words, as suggested by twisteroid ambassador, seems like a much better entropy vs. memorizability tradeoff to me.
    – Ilmari Karonen
    Commented Jul 22 at 18:18
  • Good point, and the answer is to have a minimum of n words (to prevent dictionary attacks) and at the same time m letters altogether, m>15 or whatever.
    – Peter - Reinstate Monica
    Commented Jul 23 at 1:46
2

"Strong" in what sense?

Most password complexity measurements assume that an attacker is brute-forcing, which is essentially a non-issue with anything that's not utterly trivial.

Frame challenge: Thinking about bits of entropy is common because it's easy. It doesn't address at all many of the actual ways in which passwords/passphrases get compromised. Shoulder-surfing, leaks from sites storing them unencrypted, phishing, etc.

Your password/passphrase should not be trivial to guess or brute-force. Other than that, I don't think worrying about complexity is where we should spend our time and energy.

You aren't telling us what the passwords/passphrases are used for. If you control the login mechanism, slowing down login attempts after a few false tries would make brute-forcing orders of magnitude more difficult than anything you do with the actual password/passphrase.

I also matters if users are expected to remember the passphrase or are anyway storing them in a password manager. In the former case, you need to strike a balance between usability and security. In the later case, generate 40 random characters and stop mucking about with pseudo-complexity.

Improve this answer
2
  • You aren't telling us what the passwords/passphrases are used for. They will mostly be used by myself, and I do use a password manager. However, sometimes I need to send a passhprase to someone else. In that case, I think is is less error prone, than sending a cryptic 40 character string.
    – phunsoft
    Commented Jul 23 at 9:00
  • 1
    @phunsoft if they need to type it in, yes. If they need to use it multiple times, yes. If they need it once and will likely copy&paste, it doesn't matter.
    – Tom
    Commented Jul 23 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .