Package: diceware-list
diceware-listsources|issuesCreate and check wordlists for use withdiceware.This is not adicewareimplementation, but a helper to create and check
appropriate wordlists.Currently, we provide three scripts:diceware-listcreate wordlists based on input listswlflakeschecks existing wordlists for flawswldownloaddownloads Android wordlistsInstallInstall latest release frompypi(venv) $ pip install diceware-listor clone repository from github:$ git clone https://github.com/ulif/diceware-list.gitPlease consider usingvirtualenvfor deployment.In an activevirtualenvyou can install an executable script ofdiceware-listrunning:(venv) $ python setup.py install
(venv) $ diceware-list --help
usage: diceware-list [-h] [-l LENGTH] [-n] [--ascii] [-d SIDES] [-k]
                     [--use-416] [-p {none,short,long}] [-v] [--version]
                     DICTFILE [DICTFILE ...]Create Wordlists:diceware-listThediceware-listscript creates new lists out of given ones:$ diceware-list -n -l 7776 /usr/share/dict/words
11111 a
11112 a's
...
12353 capt
12354 cara
12355 carl
...
66663 zoos
66664 éclat
66665 élan
66666 épéeThe main target ofdiceware-listis to provide “good”
wordlists. Wordlists are considered “good” if theycontain enough terms for use with a certain diceware application
(for instance 6^6 = 7776 terms if used with six six-sided dice)contain terms as short as possible (to reduce typing)(optionally) contain no words with non-ASCII chars (to enable use
with non-localized keyboards)(optionally) are aprefix code, i.e. no complete word in the list is
prefix of another word in the list.contain no offending termsThe last topic is hard to solve technically (hints welcome!), butdiceware-listcan help to follow the other design rules.The wordlists generated bydiceware-listare not meant to be kept
secret. You might put them on the internet, publish on facebook or
print them in the New York Times. Instead the security of thedicewaretechnique relies on the entropy or (in this case)
“randomness” of your dice, computer, etc.In other words: Your passphrases will not be safe because of hiding
your wordlist. They will be safe because there are so many possible
combinations of words you can pick from your wordlist. That means:
longer lists are more secure than shorter ones (if really used to full
extent by your source of randomness withdiceware), but hidden
lists arenotmore secure than public ones.UsageFirst, you need a file with words as “dictionary”. On typical Debian
systems such files can be found in/usr/share/dicts/.This file can then be fed todiceware-listto create a wordlist
suitable for use with diceware.:$ diceware-list /usr/share/dict/words
!
!!
!!!
...
alan
alana
alar
...
zzz
zzzzBy default all input words are filtered and output. Using the-loption you
can request a certain length of the output wordlist. If an input list provides
more terms than needed, we will pick a subset. If there are not enough terms in
the input list, an error is raised.With-nyou can telldiceware-listto put numbers into each line,
representing dice throws[1]$ diceware_list -n -l 7776 /usr/share/dict/words
11111 !
11112 !!
...
12353 alan
12354 alana
12355 alar
...
66665 zzz
66666 zzzzIf you create a wordlist for use with non-standard dice, for instance for
10-sided dice, then you can tell with-dlike this:$ diceware_list -n -d 10 -l 10000 /usr/share/dict/words
1-1-1-1 aol
1-1-1-2 aachen
1-1-1-3 aaron
...
10-10-10-8 zoomed
10-10-10-9 zooms
10-10-10-10 zoosThe–asciioption filters terms out, that contain non-ASCII
characters. This can help in generating non-english word lists that
are usable with regular english keyboards.The verbose option–verbosecan be given multiple times to increase
verbosity.See–helpfor other options.diceware-listfollows loosely the recommendations given onhttp://diceware.com/by Mr. Reinhold.Check wordlists: wlflakesFind flakes in wordlists.::$ wlflakes mywordlist.txtNo output means: no problems detected.We can look for prefix flakes. I.e., we check, whether any line in the given
file is the beginning of any other line.::$ cat wordlist.txt
air
port
airport$ wlflakes wordlist.txt
wordlist.txt:3: E1 “air” from line 1 is a prefix of “airport”Double entries are also shown:::$ cat wordlist.txt
air
port
air$ wlflakes wordlist.txt
wordlist.txt:1: E1 “air” from line 1 is a prefix of “air”
wordlist.txt:1: E2 “air” appears multiple timesMore checks offered bywlflakes:Warnings:
- show terms containing non-ASCII chars
- too short list entries (that are easer to bruteforce than to guess)wlflakessupports also--helpor-hto list all options supported.Handle Android wordlists: wldownloadAndroid wordlists are a nice source for wordlists. They can be downloaded from
public repositories:$ wldownload --raw -v
Starting download of Android wordlist file.
Fetching wordlist from https://android.googlesource.com/platform/pack...
Done.wldownloaddownloads these lists and helps to transform them into lists
usable for diceware. Be aware, that terms from lists are output on stdout by
default (and Android wordlists contain easily more than 100,000 terms):$ wldownload > mylist
$ cat mylist
the
to
...
yt
yukTerms are output on stdout by default (use shell redirects or--outfileto
change that behaviour).You can request non-english wordlists using--langor-lwith a
language code likecsorde. Use--lang-codesto list all supported
language codes.The--no-offensiveflag suppresses terms marked as possibly offensive.TestingIn a clone of the sources you can run tests like this:(venv) $ python setup.py testThis command will download all required packages, especiallypy.test.You can also installpy.testmanually withpip:(venv)$ pip install pytest
(venv)$ pip install -e .and afterwards run tests like so:(venv)$ py.testIf you also installtox:(venv)$ pip install toxthen you can run all tests for all supported platforms at once:(venv)$ toxCoverageTo get a coverage report, you can use the respectivetoxtarget:(venv)$ tox -e covOr you use the commoncoveragetool:(venv)$ pip install coverage
(venv)$ coverage run setup.py test
(venv)$ coverage report --include="diceware_list.py,libwordlist.py"[1]The wordlist length in this case should be(number-of-sides-per-dice)powered to(number-of-dicethrows), for instance 6**5 = 7776 for five
six-sided dice or a single six-sided dice thrown five times.Changes2.1.dev0 (unreleased)Support also Python 3.6, 3.7 andpypy3.diceware-listallows to limit the set set of allowed chars (-cor--chars).diceware-listnow allows uppercase chars in terms on request (-uor--allow-uppercase).wlflakeschecks now for non ASCII chars in lists and for terms, that are
too short and therefore easy to bruteforce.Added functions to compute entropy of wordlists and their alphabet chars.Fixed #4: terms differing in only upper/lower case, led to double entries in
result list.2.0 (2018-01-23)Add newwldownloadcommand. This is a tool for handling Android wordlists
(download, uncompress, parse).Add newwlflakescommand. This is a tool for checking existing
wordlists for consistency, cryptoflakes, etc.Thediceware-listoption-lcontains no default any more. If the option
is not set, all suitable terms are output.1.0 (2017-02-09)Thedicewarekit.txtlist is not included in generated lists by
default from now on. You can request inclusion with new optionuse-kit.  The old optionno-kitis not supported any more.In numbered output, separate digits by-to distinguish numbers
with more than one digit. Needed at least when generating wordlists
for dice with more than 9 sides.Rename-soption to-d(as indice-sides).Logging output now registered under namelibwordlist.Added new modulelibwordlistcontaining the API parts ofdiceware-list.New–versionoption.New–prefixoption. If set prefix code is generated, i.e. lists that
contain no item which is prefix of another list item.Claim support for Python 3.6.Restructure package: all single scripts are now part of a package.0.3 (2016-07-25)Install script asdiceware-listinstead ofdiceware_list.Allow–sidesoption to support dice that do not have six sides.0.2 (2016-03-18)Allow-voption multiple times for increased verbosity.Pick maximum width terms randomly. Until that change we included all
shorter entries and additionally the (alphabetically) first entries
of maximum width. Now, we pick a random set of these maximum width
entries for the result list.Claim support for Python 3.5.0.1 (2016-02-09)Initial release.