> I saw a paper with a nice method for generating passphrases. Unfortunately, I can't find it. (Can anyone help me?) DiceWare[1] doesn't do the filtering you'r

> I saw a paper with a nice method for generating passphrases. Unfortunately, I can't find it. (Can anyone help me?) DiceWare[1] doesn't do the filtering you're talking about, but it does provide a method of generating passphrases by converting entropy into words. PGP Word Lists[2] use a packing technique as well, with even/odd words for error detection. I haven't seen the paper you're talking about, but I'm highly suspicious of using an algorithm to score phrases by how close to natural language they are without a proof of security. If you score natural-ness using, for example, comparing overlapping 2-word patterns to a database, then that database becomes a Markov chain database we can use to generate passphrase guesses, greatly reducing the entropy. Generating and discarding the patterns database from natural language material for each passphrase generation helps only inasmuch as two source databases from the same language are likely to differ. Maybe that's not the method used to test natural-ness, but I suspect that the better the natural-ness scoring function is, the better the corresponding passphrase generator will be. And remember, the user is going to decrease entropy even further by choosing their passphrase. You can mitigate this by decreasing the number of passwords generated for the user to choose from, but this means less natural phrases. You can also mitigate it by increasing the passphrase space (that is, more words in your passphrase) but that decreases memorability. Personally, I use 5-word DiceWare passphrases for most things, and 6-word DiceWare passphrases for the most important stuff. The proof of security for DiceWare is simple enough that you can do it yourself and be confident in it. The intent is not long-term memorability--in the age of leaked passwords stored or transferred in plaintext, password reuse is foolish, and I've yet to come across a scheme that allows me to memorize 30+ passwords. Instead the idea is short-term memorability so I can copy the passwords manually from my password manager. In practice the memorability is completely adequate for this purpose. And even at 5 DiceWare-generated words, that's 2.8x10^19 possibilities, or a little under a year for an attacker with 1 trillion guesses per second capabilities. [1] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html [2] https://en.wikipedia.org/wiki/PGP_word_list https://en.wikipedia.org/wiki/PGP_word_list