Since they won't brute force a 19-char password, I was wondering if the attacker's dictionary is simply sorted by frequency? could these passwords have roughly the same strength?

carp ably feud whir
mailless larksome blameful girasols
  • 2
    All that matters is that enough words (4+ is ok but not great, 6+ is good) are selected from a sufficiently large dictionary (4k or more) of unique words. – AndrolGenhald Sep 24 '18 at 22:36
  • Fair ... though given that we don't know how "fast" the underlying hash is (it could be MD5!), I wouldn't consider the combination of 4 words from a 4k wordlist (4000^4) to really be even somewhat OK; it's only 2.5x10^14 combinations. For a count of 4 words, even a 20K wordlist is only 1.6x10^17. Only when you get to the size of wamerican-large (~160K words) do you start hitting 10^20 with 4 words. – Royce Williams Sep 25 '18 at 0:16
  • 1
    @RoyceWilliams of course :) it depends what your threat model is. I wouldn't be too worried about a passphrase with ~48 bits of entropy for a password manager that uses a 1 second key derivation. Not ideal, but also probably not the weakest point. If it's for an online service it could also be stored in plaintext, in which case entropy won't matter if it's leaked. – AndrolGenhald Sep 25 '18 at 13:04
  • This is like asking if a large Hamming weight for a password's binary representation makes it more secure. – forest Sep 26 '18 at 2:25

No. If you're using multi-word (diceware-style) passphrases composed of actual words, the length of each word doesn't matter.

If you assume the attacker is aware of the method you used for generating your passwords (which you should, per Kerckhoffs's principle), then you can expect that the attacker will attempt to crack your passphrase with a dictionary attack and therefore the word length is irrelevant; only the number of words and the size of the dictionary you randomly selected them from matters.

If you assume the attacker isn't aware of your scheme and is just using brute force, then you can expect the attacker will take many orders of magnitude longer than they otherwise would using a dictionary attack, therefore since your password is designed to stand up to a dictionary attack it is also safe against brute force.

To make that more concrete, assuming you chose "carp ably feud whir" randomly from a 7776-word diceware dictionary, the attacker must try an average of 77764/2 ~= 1.83 quadrillion passwords before cracking it. If instead the attacker used a brute force of lower-case letters and spaces, you'd instead expect this same attack to take (26+1)19/2 ~= 786 billion quadrillion tries on average. Since 786 billion quadrillion is greater than 1.83 quadrillion, you can safely conclude that the brute force attack isn't worth worrying about, as the dictionary attack is a much more significant threat, and therefore the length of each word doesn't matter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.