# What is the entropy of just 1 Diceware passphrase like my passphrase?

A 5-word Diceware passphrase gives an entropy of 7776^5 = 3E19 = 19 Bans (or ~64 bits). Apparently monster cracking systems can currently guess passphrases for MD5 at a rate of 180 billion/sec (2E11). See monster system

That system would find my passphrase with an entropy of 19 bans in at most 3E19/2E11=1.5E8 seconds. Or, since 4 month have 1E7 seconds, it would take on average 0.5(1.5E8/1E7) = 0.8E1=8 of 4 month periods, or about 2.5 years. More precise: 0.5(2.8E19/(1.8E11*3.7E7)=2.4 years.

The term on average outrules, I think, a crack estimate of my single Diceware passphrase. Suppose I know the attacker's crack sequence:111111 11112 etc. Then I can calculate how long cracking my passphrase such as "afire akin been snout tress" would take.

If my math is right, it would take about 10x6667x6667x6667x6667=2.0E16 guesses (suppose afire is word 10in the list) which is much less then 0.5* 3E19 for large sets of passphrases when on average starts working.

Can the "If I know the attacker's crack sequence" perhaps be broken and can "on average" be brought back by first randomly sorting a Diceware word list before throwing the dices?

• @Dick99999 If you knew in which order the passwords are cracked, you would simply pick the last password. If password crackers did process passwords in order then everyone would pick `@ @ @ @ @` as the most secure password. It doesn't work that way! Password cracking might prioritize “easy” passwords, but they do not operate in any order that resembles dictionary order. If anything, the passwords may be ordered by their hash — but the hashes would be traversed in a pretty much unguessable order anyway, and in parallel. May 21, 2013 at 18:33