5

A while ago, the EFF published new wordlists to be used with diceware, to create passphrases with “better” words.

One variant is the “short word list (with words that have unique three-character prefixes)”. They write about this list

Finally, we're publishing one more short list [.txt] which with a few additional features making the words easy to type:

  • Each word has a unique three-character prefix. This means that future software could auto-complete words in the passphrase after the user has typed the first three characters
  • All words are at least an edit distance of 3 apart. This means that future software could correct any single typo in the user's passphrase (and in many cases more than one typo).

We've added these features in the hope that they might be used by software in the future that was specially designed to take advantage of them, but will not offer a significant benefit today so this list is mostly a proof-of-concept for individual users. Software developers might be able to find interesting uses for this list.

But why would they hope for software developers to implement auto-complete? Couldn’t they just tell the users “remember the whole world, but just type the first three characters” to get the same effect – no loss of security, but shorter passphrases?

Also, I noticed that the list contains words like viperfish that seem awfully redundant – wouldn’t the shorter word viper work just as well in its place? Similarly, mapmaker could just be map, capsule could be cap, older could be old. Is there a reason why they have not just chosen the simplest, shortest english word for a given three-letter prefix?

4

Using cap, old and (presumably) viper would ruin the edit distance guarantee.

I imagine that users don't want to just type the first three letters - it can be less mental effort to type words. There's another common scheme where you take a longer sequence of words and include only the first letter from each word: Which approach you prefer is largely a matter of taste.

| improve this answer | |
  • Yeah, the edit distance is it, I guess. Not sure how it helps if you have auto-complete after 3 characters. – Joachim Breitner Aug 13 '18 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.