Is there a better Diceware word list?

Question

I use Diceware to generate passphrases, and am very happy with the ease of the process and the security of the results.

Where I have an issue is with the word list itself.

• It contains problematic words like "rape" and "negro" that I can't reasonably use in a passphrase I want to send to a third party.
• It contains many obscure words like "eagan" and "scurry" that are hard to remember how to spell.
• it contains things like "dx" and "vh" and "a&p" that aren't words at all. "a&p13fk93c'sy" is a valid Diceware passphrase that is just as hard to remember as a truly randomly generated password.
• It contains many very short words, so it is possible for a strong six-word Diceware password to only be 6 characters long.

Of course, you can re-run the generation process if you get a bad passphrase, but that reduces entropy.

Since rejecting unsuitable passphrases reduces the entropy, are there alternative word lists available, or is there some other strategy to ensure Diceware only generates useful passphrases?

Answer 1

While the Diceware passphrase generation system is sound, you aren't the first person to express concerns about the default wordlist. The nice thing is that you can create your own wordlist that works with Arnold's system. That gives you flexibility in eliminating offensive words and replacing words deemed too short or obscure.

In fact, several organizations have already created their own word lists for use with Diceware. The most recent was Joseph Bonneau's work for the EFF to develop several wordlist variations that focus on improving usability of the resulting passphrases. This is really great work and is the first place I'd point you when considering an alternative to the default wordlist.

As far as the possibility of generating short passphrases with the original word list, I estimated that 0.00037% of possible 5 word combinations would be eliminated if you rejected anything shorter than 14 characters (assuming spaces separate words). So while it's not ideal to reduce overall system entropy, this has a very small impact on security.

Arnold also recommends separating words with spaces, so that should pad even a 6 word passphrase composed of single letter words to 11 characters.

Answer 2

In addition to the EFF lists which PwdRsch mentions in his answer, you can look for word lists from a literary corpus such as the Corpus of Contemporary American English, the Brown Corpus, or the Moby Project. These have been analyzed enough that you can probably find usage frequencies for them to narrow down your word list to common words only.

That leads to a couple other ideas. If you want common words, why not find lists of words for teaching language to non-native speakers, such as the New General Service List? Or maybe you can find a list of words taught to children on a teaching resources site of some kind (I was not able to find a long enough list for free).

You may be able to find frequency analysis of a kind in spell checker lists to obtain and focus a list from there. Some dictionaries may have this information available, especially for a fee; for a free option, wiktionary has frequency lists in addition to their full index.

Unfortunately this sort of information is not all that easy to come by, as evidenced by the fact that people are apparently still doing active research to find frequent or memorable words. That's about all I could find while looking for word lists for a keepass plugin to which I contribute.

Answer 3

The creator of Diceware addresses some of these issues in the FAQ.

• Look up the obscure words in a dictionary; this will help you remember them.
• The short non-words are there to keep the passphrase short for the convenience of people who have to type their passphrase in many times a day
• If your passphrase is under 14 characters long throw it away and roll a new one; the reduction in entropy is small enough not to worry about.