Timeline for Would turning a Diceware phrase into a sentence decrease its security?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 5, 2016 at 23:23 | vote | accept | mayhewluke | ||
| Mar 27, 2016 at 3:30 | comment | added | Cort Ammon | @BenVoigt Good point, I misspoke | |
| Mar 27, 2016 at 2:58 | comment | added | Ben Voigt | @CortAmmon: That's clearly baloney, a malicious oracle CAN decrease the entropy as PyRulez suggested. Consider the formation of a sentence that concatenates ALL words in the diceware dictionary (ok, it'd have to include them all N times in order to meet the "in order" requirement). That same passphrase could be returned for every possible input. That's of course an extremely long output; length restrictions will limit the entropy loss but not eliminate it. | |
| Mar 27, 2016 at 1:49 | comment | added | Cort Ammon | @PyRulez True, though as an exercise to the reader, I leave it to demonstrate why such a non-injective process does not decrease the security of the sentence in the presence of such an oracle attack. It can even be shown that this security remains true, even if the attacker gets to provide you with an oracle of their own which takes the diceware words and turns them into a sentence containing those words in order, no matter how malicious that sentence generating oracle is. | |
| Mar 26, 2016 at 23:21 | comment | added | Christopher King |
Another thing to note is that this process is not injective. tracy optic renown, tracy optically renowned, and tracy optic worldwide may both generate tracy is optically renowned worldwide.
|
|
| Mar 26, 2016 at 22:01 | comment | added | LSerni | Good point on the dangers of rejecting Diceware word sets for being difficult to weave into a sentence. | |
| Mar 26, 2016 at 20:58 | history | answered | Cort Ammon | CC BY-SA 3.0 |