Imagine I create a passphrase using random dictionary words but a common grammatical structure (eg: article, noun, verb, adjective, noun
). Given a pretty small dictionary of 5000 words, how vulnerable are such phrases compared to:
- passwords with the usual recommendation of 8-16 characters, upper, lower, numbers
- some phrase you make up yourself based on your favourite book, poem, quote, or whatever
- diceware style phrases (5 random words stuck back-to-back)
- the PGP recommendation of "shocking nonsense" (which is similar to what I'm doing)
A few examples of what I'm thinking of:
its headlock fumbled my angle
should its mimosa withstand an oath
a harpoon might expertly staff our ratios
the Sumerian ambushes the tiny murmur
Are there known ways to attack such passphrases beyond checking for common words first in a brute force attack? Can you think of a better way than this?
How effective would Markov Chains or n-grams be based on large word corpus's (eg: Google Web or Brown)? My gut feel is the 'nonsense' nature of the phrases would mitigate many common chains of words, but is there any research or off-the-shelf cracker I could use to verify that?
Effect of Grammar on Security of Long Passwords is relevant, they even highlight a nonsense passphrase of their own as unexpectedly good (hammered arsine requirements), but my understanding of their paper is they're trying most common words first. This question is also relevant.
Full disclosure: I'm developing a passphrase generator which uses this grammatical technique to assist memorisation, but still keeping the words used random. I'm interested in some critique of my algorithm, while still fitting within the Q&A style of Stack Overflow.