3

A 5-word Diceware passphrase gives an entropy of 7776^5 = 3E19 = 19 Bans (or ~64 bits). Apparently monster cracking systems can currently guess passphrases for MD5 at a rate of 180 billion/sec (2E11). See monster system

That system would find my passphrase with an entropy of 19 bans in at most 3E19/2E11=1.5E8 seconds. Or, since 4 month have 1E7 seconds, it would take on average 0.5(1.5E8/1E7) = 0.8E1=8 of 4 month periods, or about 2.5 years. More precise: 0.5(2.8E19/(1.8E11*3.7E7)=2.4 years.

The term on average outrules, I think, a crack estimate of my single Diceware passphrase. Suppose I know the attacker's crack sequence:111111 11112 etc. Then I can calculate how long cracking my passphrase such as "afire akin been snout tress" would take.

If my math is right, it would take about 10x6667x6667x6667x6667=2.0E16 guesses (suppose afire is word 10in the list) which is much less then 0.5* 3E19 for large sets of passphrases when on average starts working.

Can the "If I know the attacker's crack sequence" perhaps be broken and can "on average" be brought back by first randomly sorting a Diceware word list before throwing the dices?

|improve this question
5

You're worried that you might by accident take a passphrase that comes early in the list, which would cause your passphrase to be guessed a lot earlier than one might expect on average. Here are two reasons why this worry is baseless.

Your passphrase is (if you're doing things correctly) already randomly generated. This means that there is (e.g.) a 1/100 chance that the first word of the passphrase falls within the first 1% of the list. This is independent from the order of the list, and is independent from the order in which the attacker tries passphrases. Shuffling the list would not change that: the first word of your passphrase would still have a 1/100 chance of being within the first 1% of the shuffled list.

You cannot know the order in which the passphrases will be cracked anyway. Any reasonable passphrase cracker is massively parallel. Furthermore acceleration techniques (such as rainbow tables) lead to making attempts in an order that is pretty much random (on a cognitive sense, if not in a cryptographic sense). You do not know the attacker's crack sequence.

|improve this answer
  • Talking after the coice... – Dick99999 May 21 '13 at 15:27
  • Sorry. yes I am worried that a passphrase would be guessed earlier. Agree to the 1/100 reasoning up to the moment the phrase has been chosen. After that I know which phrase I have and assume that the dictionary is known. Now suppose my phrase start with the first word of the dictionary. A simple algorithm (5 words: first 1,1,1,1,1 then 1,1,1,1,1,2 etc), will succeed at 1,x2,x3,x4,x5 thus reducing the entropy by roughly one word. I assume that I know in which order phrases are cracked. For simple crackers I think I know, but I have not checked that. So you are right, I am not sure. – Dick99999 May 21 '13 at 15:42
  • @Dick99999 If you knew in which order the passwords are cracked, you would simply pick the last password. If password crackers did process passwords in order then everyone would pick @ @ @ @ @ as the most secure password. It doesn't work that way! Password cracking might prioritize “easy” passwords, but they do not operate in any order that resembles dictionary order. If anything, the passwords may be ordered by their hash — but the hashes would be traversed in a pretty much unguessable order anyway, and in parallel. – Gilles May 21 '13 at 18:33
  • Thanks for that info, I didn't know that. If I knew the guess sequence, I'd not take @ @ @ @ @ , but I'd randomize the sequence of words in my dictionary. It seems now, that a cracker introduces randomness by not using the dictionary in a predetermined order. – Dick99999 May 22 '13 at 7:39
  • Isn't ordering passwords by their hash only possible in rainbow tables? Those seem impossible for even 4 word Diceware phrases(3E15 combo's). And likely also impossible for 3 word phrases with a single random modifier character inserted. – Dick99999 May 23 '13 at 5:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.