I do password cracking for customers from time to time (to know whether their employees use good passwords). Here's how I would attack your passphrase or password.
First off, we should assume the key or password is secret, not the method that it was made with (Kerckhoff's principle). I may not know the details, for example which dictionary you used, but I can usually work around those limitations, in this example by using a sufficiently large dictionary. In most organisations passphrases are not common, but recently we found a single passphrase after doing a dictionary attack (a "dictionary" consisting of previously cracked passwords). I followed up on the pattern and it turned out there were more four-word phrases among the sysadmins. Always assume the method is, or will become, known.
So given that I'll probably find out how you generate your passwords, let's see how I would approach an organisation with a mix of various password styles:
1. Try to find standard passwords
Most people choose predictable passwords. One or sometimes two words, uppercase the first letter of each word, numbers at the end, sometimes special characters, often leetspeak. There have been so many attacks on these kinds of passwords that a large dictionary (containing previously cracked passwords) plus some mangling rules is usually sufficient.
Assuming standard (poor) password storage such as Microsoft's hashing scheme, cracking takes a few hours, depending on the mangling rules.
2. Start a brute force attack
After that is done, I usually run a brute force attack for a few hours or days to find any "short" (up to and including 8 characters usually) passwords that the dictionary missed. This usually results in nothing, but sometimes it works and then it's great because the person probably thought they were quite secure by memorizing random characters, so it's often an important password.
3. Analyse the results so far
While the brute force is running, have a closer look at the previous results. Any patterns?
The example I mentioned before was a long password, something like: F4stH0nd4F4stH0nd4. So I found a list of all adjectives (like "fast"), car brands (like "Honda"), made a list of all possible combinations, and fed it to Hashcat with some custom rules:
- replace "a" with 4 and "o" with 0,
- uppercase the first letter of each word,
- then write it twice after each other.
This is not really a passphrase because passphrases are supposed to be random, nonsensical words ("correct horse battery staple"), but it's similar. But let's say I found an actual passphrase, maybe someone actually used correct horse battery staple? Or a real phrase like "MaryHadALittleLamb"? Then I would continue with passphrase cracking.
4. Try to find standard phrases
Similar to how standard dictionaries and previously cracked passwords can be used for cracking more passwords, I can use pre-existing phrases for cracking passphrases. I did some research on this which is available here. In summary, downloading Wikipedia and trying every possible subsentence combination yields good results. A lot of people just use an existing phrase rather than random words, and Wikipedia contains a lot of phrases.
5. Start a passphrase brute force attack
Where step 4 was similar to step 1, this step is similar to step 2, except we now don't try all possible characters but all possible words. Take a reasonably-sized dictionary and just start trying combinations. First two-word combinations, then three-word, and if you have time left then try four-word combinations. A few mangling rules are needed like putting spaces between words or uppercasing the first letter of each word (or a combination thereof).
This is very rare, though, and so this will almost never yield any results. If passphrases become more popular it might become more effective. Or if you have a specific target person (if you work for a security agency) and you observed that they had a long password, this would be a good thing to try.
In conclusion, a password or passphrase is only as strong as the method by which you generated it. You can have a strong 16-character random password or a strong 6-word random passphrase, it doesn't really matter. Entropy is a fancy way of saying "number of random guesses needed", and that's all that counts, because each extra character or word adds an exponential amount of guesses necessary and you can easily get to a point where no computer could realistically guess it.