4 ms·

These passwords are not reselient to complicated attacks and are more easily cracked than randomly generated passwords. Limit the dictionary to the top Xk most

These passwords are not reselient to complicated attacks and are more easily cracked than randomly generated passwords. Limit the dictionary to the top Xk most common English words, if leetspeak substitution is used you can also easily mask it. We did this experiment and even randomly generating 6 word passwords using Wikipedia as dictionary resulted in passwords which are faster to crack than 16 character randomly generated passwords and that is because you can’t count the entropy as single characters sure if you brute force it char by char it will take longer but if you use words as your base unit then you only need to find 4-6 from a fairly limited pool of possibilities. You can further limit it down by using grammar rules if your target is using passphrases those are even faster to crack and can be generated using markov chains or any basic grammar rule engine.

lucb1e 8y ago
> These passwords are not reselient to complicated attacks and are more easily cracked than randomly generated passwords. There is no fundamental difference. Either your pool of elements consists of 95 different symbols (ASCII printable characters and space) and you get passwords like 'F~iV3Bcv>\Q@' or your pool of elements consists of thousands of words and you get passwords like 'hubs exempted contend catchment others'. As per Kerckhoff's principle, we should assume that the method of generating the password is known (which set of elements, i.e. your charset or dictionary, which RNG was used, and perhaps the length of the password). The resulting strength in terms of bruteforceability of its hash is equal. Assuming one picks sane values, e.g. 6 elements when using a 7800 element set, or 12 elements when using a 95 element set, both are safe to use. > randomly generating 6 word passwords using Wikipedia as dictionary I don't understand what you mean by "using Wikipedia as dictionary". Wikipedia contains whole sentences. Did you download a dump of the English Wikipedia and split it on non-word characters and use that as dictionary? Did you remove duplicate words? Or did you take Wiktionary's words? > if you use words as your base unit then you only need to find 4-6 from a fairly limited pool of possibilities. I think you're wrong, but feel free to prove me wrong :). Here are some hashes: f4cd51713a3ac5798b3a0b40fe61aa2f f424f3432b7acbce2c2d3548490c9cc0 71fa597116bfc54ecc6c48162629d391 beb09edbc493bf826b61afa6905712df 42251a29996a78ef023bdb03a8c22ea9 3a80f15bd82c4f4c0a3338a1fa86adb9 They were generated using this script: function genphrase { x=$1; while [ $x -gt 0 ]; do echo -n $(shuf /usr/share/dict/words | grep -v é | grep -v \' | tail -1)\ ; let x=$x-1; done; } for i in {1..6}; do phrase="$(genphrase $i)"; sum=$(echo -n "$phrase" | md5sum | awk '{print $1}'); echo "$sum $phrase"; done; Basically I take random words from /usr/share/dict/words so long as it does not contain an apostrophe or an accented e. The md5 hash of the result is generated, a very fast and well-supported algorithm (your favorite cracking program should support it without any trouble). As an example, from another run of the script, here is one of its output lines: 75e6881687661e09e404b517e7ee2ce3 goodliest villeins gymnast You can use this sample output to verify that the hash is generated correctly and that your tool works. I expect the first two hashes should not be an issue, the third might be harder, the fourth would be impressive, and I expect that the fifth and sixth will remain uncracked. The dictionary version is 2018.04.16-1 (wamerican package in Debian), I uploaded it here: https://lucb1e.com/tmp/words https://lucb1e.com/tmp/words (watch out clicking the link, it's a large file and your browser may just display it instead of downloading it) > You can further limit it down by using grammar rules if your target is using passphrases those are even faster to crack and can be generated using markov chains or any basic grammar rule engine. At least in my research, I've found that markov chains and n-grams are of much worse quality and slower than just using raw phrases from public sources. The downloading and processing of those sources takes more time, but that's a one-time action and not really part of the cracking process. And as I said in the comment you're replying to, if your 'phrase' is not random words but actually a logical 'phrase', then it's not suitable as passphrase. I think you're confusing random phrases with logical sentences.

lucb1e 8y ago

> These passwords are not reselient to complicated attacks and are more easily cracked than randomly generated passwords. There is no fundamental difference. Either your pool of elements consists of 95 different symbols (ASCII printable characters and space) and you get passwords like 'F~iV3Bcv>\Q@' or your pool of elements consists of thousands of words and you get passwords like 'hubs exempted contend catchment others'. As per Kerckhoff's principle, we should assume that the method of generating the password is known (which set of elements, i.e. your charset or dictionary, which RNG was used, and perhaps the length of the password). The resulting strength in terms of bruteforceability of its hash is equal. Assuming one picks sane values, e.g. 6 elements when using a 7800 element set, or 12 elements when using a 95 element set, both are safe to use. > randomly generating 6 word passwords using Wikipedia as dictionary I don't understand what you mean by "using Wikipedia as dictionary". Wikipedia contains whole sentences. Did you download a dump of the English Wikipedia and split it on non-word characters and use that as dictionary? Did you remove duplicate words? Or did you take Wiktionary's words? > if you use words as your base unit then you only need to find 4-6 from a fairly limited pool of possibilities. I think you're wrong, but feel free to prove me wrong :). Here are some hashes: f4cd51713a3ac5798b3a0b40fe61aa2f f424f3432b7acbce2c2d3548490c9cc0 71fa597116bfc54ecc6c48162629d391 beb09edbc493bf826b61afa6905712df 42251a29996a78ef023bdb03a8c22ea9 3a80f15bd82c4f4c0a3338a1fa86adb9 They were generated using this script: function genphrase { x=$1; while [ $x -gt 0 ]; do echo -n $(shuf /usr/share/dict/words | grep -v é | grep -v \' | tail -1)\ ; let x=$x-1; done; } for i in {1..6}; do phrase="$(genphrase $i)"; sum=$(echo -n "$phrase" | md5sum | awk '{print $1}'); echo "$sum $phrase"; done; Basically I take random words from /usr/share/dict/words so long as it does not contain an apostrophe or an accented e. The md5 hash of the result is generated, a very fast and well-supported algorithm (your favorite cracking program should support it without any trouble). As an example, from another run of the script, here is one of its output lines: 75e6881687661e09e404b517e7ee2ce3 goodliest villeins gymnast You can use this sample output to verify that the hash is generated correctly and that your tool works. I expect the first two hashes should not be an issue, the third might be harder, the fourth would be impressive, and I expect that the fifth and sixth will remain uncracked. The dictionary version is 2018.04.16-1 (wamerican package in Debian), I uploaded it here: https://lucb1e.com/tmp/words https://lucb1e.com/tmp/words (watch out clicking the link, it's a large file and your browser may just display it instead of downloading it) > You can further limit it down by using grammar rules if your target is using passphrases those are even faster to crack and can be generated using markov chains or any basic grammar rule engine. At least in my research, I've found that markov chains and n-grams are of much worse quality and slower than just using raw phrases from public sources. The downloading and processing of those sources takes more time, but that's a one-time action and not really part of the cracking process. And as I said in the comment you're replying to, if your 'phrase' is not random words but actually a logical 'phrase', then it's not suitable as passphrase. I think you're confusing random phrases with logical sentences.