What should a secure passphrase look like?

Question

We all know that passwords should not only be randomly generated, but also look random. The reason is that attackers can use patterns or existing words to be able to bruteforce the passwords faster, so a randomly generated password that (by pure chance) looks like wwwtroy31 is less secure than a randomly generated password like 2ug9wf4v. The question is: should the same reasoning apply to passphrases? How? What should a secure passphrase look like? What kind of passphrases should be discarded, even if we generate them completely randomly?

Answer 1

The concern is perfectly valid for short passwords like a PIN for a payment card. If you generate a random four digit PIN, you have a 0.01% chance of generating “1234”, a 0.05% chance of generating “flush“ in format n & (n + 1) & (n + 2) & (n + 3)^*, a 0.07% chance of generating “reverse flush” (n & (n - 1) & (n - 2) & (n - 3)^*), a 0.1 % chance of generating a PIN that has all digits the same and so on. Maybe those probabilities are low, but they are still non-negligible and when you sum all of them (and ideally add some other undesired patterns), the likelihood of having one increases.

Adding some rules for PIN generation is a bit tricky, however. If you are too eager to reduce the PIN space, then the attackers also have a smaller set of potential PINs to try.

The longer the password is, the less this is a real threat. For a 6 character password (^[a-zZ-Z0-9]{6}$, uniformly distributed), generating passwords like “123456” is rather unlikely (but still somewhat plausible). When you generate a password using 128 bits of entropy, the probability that you will happen to generate an obvious password that crackers would guess is almost zero.

The same applies for passphrases, except that entropy estimation is harder for passphrases than for random passwords.

---

_{* The “&” operator is string concatenation.}

Answer 2

Discard a passphrase if:

• It appears in a previous breach, e.g. you could use the haveibeenpwned k-anonymity API to check against millions of previously leaked passwords.
• It is so short it can be brute-forced, e.g. "i do a is me" is only 12 lowercase-only characters which is really pushing it for length.
• It has obvious patterns or repeats, e.g. "password 123 password 123 password" would probably be a bad passphrase.
• It's a song lyric or Bible verse or famous quote. Don't search the Internet for this obviously, work from a local database or your memory.
• You're going to mistype it a lot because of an exceptionally obscure or hard-to-spell word or something.

That's all I could think of. Short answer: yes, the logic still applies in theory. It's unlikely to come up in practice though.

Answer 3

Yes I know the question is "passphrase", but I need to ease in.

Much of the password "Best Practice" promulgated for years is not only of dubious value, it's positively bad. Standard checkbox security requires things like:

15 characters, upper case, lower case, numbers, special characters, no repeats, no patterns, squirrel noises and moose calls

Ironically as the length and complexity grows, human nature and memory results in writing down the complex passwords, creating more narrow memory patterns, and re-using the ugly things once you finally remember them. Re-use is especially bad. Sticky notes with impossible phone numbers corresponding to letters and numbers are quite common.

This is all aimed at defending against high speed dictionary variant attacks. In most cases, this is the wrong threat vector. Remote attacks, online attacks, should be simply blocked after a handful of failures. It doesn't take 15 characters of rutting sounds, simply avoiding the top 100 poor ones like password and 123456.

Many corporate and government security entities run crackers against your password hashes in their domain servers and declare your password bad if they break it after weeks of high speed attacks. Seriously? If attackers are in your network running high speed attacks, password complexity is the least of your problems.

Now on to passphrases.

Again, consider the intended purpose. If it's for remote login, the same block after 5 or so failures applies and complexity is of little concern.

The real concern is direct attack. Usually passphrases are used for drive/file encryption. If your file or drive is subject to attack, then complexity and attack speed come into play.

Classic analysis might assume English words where a 50,000 word dictionary would be 90% coverage. An unknown length with a strong probability of 3 to 10 words. Most likely a proper sentence following grammar rules would dramatically trim the probability down to something very difficult but not improbable.

However, statistics alone don't tell the full story. The encryption implementation comes into play as well. If the hash round count is large enough (I think Veracrypt is around a million), then each brute force attempt takes a long time. It no longer becomes practical to high speed crack. Veracrypt even allows you to define an alternate secret round count, so now you have many thousands of possibilities of those as well.

So while it can be mathematically argued that 90% of English language passphrases can be iterated through in an acceptable time period, verifying that you have the right one when each wrong verification takes a significant chunk of time precludes this as a viable attack.

Avoid common phrases, throw in some non-dictionary and you're probably solid.