Let's assume person A chooses 15 words for a passphrase with an average length of 5. The passphrase meets following conditions.
- The first word is not a valid word and can't be found in any dictionary. It's twice the length of the average word and meets all conditions for a well password.
- Word n=2 until word n=7 are not random, created by person.
- Word n=8 until word n=15 are truly randomly generated.
- All valid words are coming from 3 different languages.
- 4 random special characters are mixed into the passphrase at random position.
- 4 digits are mixed into the passphrase at random position.
- One letter is capitalized.
- All words separated by space.
I understand that:
- The not valid word increases probably the security with increasing length, because it's like a password.
- The not random part decreases the security with increasing length.
- The truly randomly generated part increases the security with increasing length.
- The usage of multiple languages increases the search space.
- Points 5-7 increase the security, if chosen truly randomly.
What I want to know is: How to rate the overall security of this passphrase?
Because the security can still be dramatically increased or decreased through a combination of this parts.
Scenario 1: Person B doesn't know anything about the creation.
Scenario 2: Person B has partial knowledge of the passphrase:
- That the first word isn't a word.
- That there must be a random and a not random part.
- That the words are coming from different languages.
- That there are digits and special characters are mixed in.
- That the passphrase may contain capitals and they may be separated.
Maybe more, if I forgot something.
Scenario 3: Person B knows everything about the creation rules of the unknown passphrase.
How would Person B proceed in the various scenarios and what would be the overall outcome of their efforts?