Diceware

From Wikipedia, the free encyclopedia
Jump to: navigation, search
Diceware passwords are generated by rolling a six-sided die five times to generate a five-digit number, which corresponds to a single word

Diceware is a method for creating passphrases, passwords, and other cryptographic variables using an ordinary dice as a hardware random number generator. For each word in the passphrase, five rolls of the dice are required. The numbers from 1 to 6 that come up in the rolls are assembled as a five-digit number, e.g. 43146. That number is then used to look up a word in a word list. In the English list 43146 corresponds to munch. By generating several words in sequence, a lengthy passphrase can be constructed.

Lists have been compiled for several languages, including Chinese, Danish, Dutch, English, Esperanto, Finnish, French, German, Italian, Japanese, Maori, Norwegian, Polish, Romanian, Russian, Spanish, Swedish and Turkish. A Diceware word list is any list of unique words, preferably ones the user will find easy to spell and to remember. The contents of the word list do not have to be protected or concealed in any way, as the security of a Diceware passphrase is in the number of words selected, and the number of words each selected word could be taken from.

The level of unpredictability of a Diceware passphrase can be easily calculated: each word adds 12.9 bits of entropy to the passphrase (that is, bits). Originally, in 1995, Diceware creator Arnold Reinhold considered five words (64 bits) the minimal length needed by average users. However, starting in 2014, Reinhold recommends that at least six words (77 bits) should be used.[1]

This level of unpredictability assumes that a potential attacker knows that Diceware has been used to generate the passphrase, knows the particular word list used, and knows exactly how many words make up the passphrase. If the attacker has less information, the entropy can be greater than 12.9 bits per word.

The above calculations of the Diceware algorithm's entropy assume that, as recommended by Diceware's author, each word is separated by a space. If, instead, words are simply concatenated, the calculated entropy is slightly reduced due to redundancy; for example, the three-word Diceware phrases "in put clammy" and "input clam my" become identical if the spaces are removed.

EFF wordlists[edit]

The Electronic Frontier Foundation published three alternative English diceware word lists in 2016, further emphasizing ease-of-memorization with a bias against obscure, abstract or otherwise problematic words; one tradeoff is that typical EFF-style passphrases require typing a larger number of characters.[2][3]

Snippet[edit]

The original diceware word list consists of a line for each of the 7,776 possible five-die combinations. One excerpt:[4]

...
43136   mulct
43141   mule
43142   mull
43143   multi
43144   mum
43145   mummy
43146   munch
43151   mung
...

Examples[edit]

Diceware wordlist passphrase examples:[2]

  • dobbs bella bump flash begin ansi
  • easel venom aver flung jon call

EFF wordlist passphrase examples:[2]

  • conjoined sterling securely chitchat spinout pelvis
  • rice immorally worrisome shopping traverse recharger

Swedish-language example:[2]

  • dika spasm sans bygel slyna nr

See also[edit]

Notes[edit]

  1. ^ Brodkin, Jon (2014-03-27). "Diceware passwords now need six random words to thwart hackers". Ars Technica. 
  2. ^ a b c d "Change Your Password: This New Word List Makes the Diceware Method User Friendly". Observer. 22 September 2016. Retrieved 4 December 2016. 
  3. ^ "EFF's New Wordlists for Random Passphrases". Electronic Frontier Foundation. 19 July 2016. Retrieved 4 December 2016. 
  4. ^ "Diceware wordlist". Retrieved 4 December 2016. 

References[edit]

External links[edit]