I understand the basics of why diceware produces good security and why seven word passphrases are a good idea these days.
The EFF has helpfully produced updated diceware lists that eliminate lots of the hassle of memorizing diceware passphrases. (see https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases)
But a seven word passphrase even using the EFF's new long diceware list can still be hard to remember. Sure, over time, most people will remember it, but I wondered if there is not a simpler way to achieve security and memorability.
(Apologies in advance if this is a rehash of something much smarter people have already thought of.)
Since knowledge of the diceware list is irrelevant, because only the length of the list of unique words contributes to the entropy, then presumably choosing from multiple lists is as secure as choosing over and over from one list.
So why not create four separate lists, each with 7,776 words, but each strictly limited to either a) adjectives, b) nouns, c) verbs, and d) adverbs?
A diceware passphrase would be created normally, rolling 5 dice for each word.
But, assuming we are aiming for a seven word passphrase, we would choose:
word 1 from list a (adjectives) word 2 from list b (nouns) word 3 from list c (verbs) word 4 from list b (nouns) word 5 from list d (adverbs)
This would produce an English sentence of the form:
adjective noun verb noun adverb (e.g. blue fireplace eats dog briskly)
which would be probably bizarre but also easily memorable for most people (with no less entropy than a five word passphrase chosen from the standard diceware list or from EFF's improved long diceware list).
That's not long enough for security though, so we could continue and choose:
word 6 from list b (nouns) word 7 from list d (adverbs)
resulting in a 7 word passphrase of the form:
adjective noun verb noun adverb noun adverb (e.g. blue fireplace eats dog briskly television enough)
Slap an "and" between the 5th and 6th word and the sentence probably is as easily memorable. Presumably the "and" cannot decrease security because even knowing it, we still have 7776^7 word combinations in the sentence.
I assume the biggest problem with this scheme is there may not be 7,776 adverbs in the English language (or maybe there is?).
In that case, we can still use a similar scheme, using two sentences constructed only from lists of adjectives (of which there are probably an order of magnitude more than necessary in English), nouns, and verbs, like so:
word 1 from list a (adjectives) word 2 from list b (nouns) word 3 from list c (verbs) word 4 from list b (nouns) word 5 from list b (nouns) word 6 from list c (verbs) word 7 from list b (nouns)
Slap a semicolon or period between words 4 and 5 if you want and you get something like this:
adjective noun verb noun noun verb noun (e.g. blue fireplace eats dog; television flies pizza)
I speculate these types of sentences are more easily memorable for most people because they create action images which people can remember easily. In the example above, it would be of a blue fireplace eating a dog, while a TV is flying on a pizza.
An 8 word passphrase could be made by including an adjective in the second sentence too, obviously.
Is this a strategy already explored?
Does it have known weaknesses?
Are there published diceware lists of nouns, verbs, and adjectives? (And adverbs?)