Talk:Diceware

message: * Dialdice: Attemt at an easy-to-dial-on-a-phone version. Maybe it should be peer-reviewed for some statistical weakness beyond my (very superficial) understanding, but anyway - here it is
When I looked at that web page today,
I saw a standard Diceware word list -- it has 7,776 unique words, so it's just as statistically secure as any other Diceware word list.
It doesn't say anything about telephones, so I'm mystified as to why it's called "Dialdice" and why the original poster thought it had somthing to do with telephones.
--DavidCary 04:40, 19 May 2005 (UTC)
thread_title: Dialdice

message: I have written a small Perl script to bring Diceware some new features. I call it the Dice Road Dictionary.  It offers three words for each dice roll: A dictionary word, an apg word and a 6 byte word from /dev/urandom.  The main thing it brings to the table is the ability to create dicware lists in other languages and to mix words, FIPS-180 words and a random string to form a password.
As to why bother ? It offers a low tech way to generate passwords that is intrinsically trustworthy.  It is still useful for off-line activities where a strong password is needed.
As to writing it on paper and keeping it in your wallet-- if your junk is getting checked, what about your wallet ?  — Preceding unsigned comment added by Chiefoperator (talk • contribs) 00:38, 17 January 2011 (UTC)
replies: text: And I have removed it, per WP:EL, WP:SPAM, and WP:COI. Please refrain from adding links to websites you are affiliated with. - MrOllie (talk) 13:29, 17 January 2011 (UTC)
thread_title:  external link 

message: On the other hand, the construction of passphrases from thusly selected words needs consideration. Simply concatenating randomly chosen words may form words that are already in the word list, e.g., "in" and "put" form "input"; all three words can be found in the above mentioned word list. This decreases the entropy. A simple remedy could be to put spaces or other characters between the words, with the added benefit of increasing the entropy.
I wonder how serious the impact of wordlist collisions is on the entropy of pass phrases. I have analyzed 5 word lists. The original Diceware list has > 2700 collisions, such as:
agee  	ag 	ee  	age	e
abode 	ab 	ode 	abo	de
acetic	ac 	etic	ace	tic
acton 	ac 	ton 	act	on
ampere	amp	ere 	   	
Most of them occur because Diceware includes all single characters and most combination of 2 characters as 'words'. But there are other collisions as well. It may imply that my 4 word phrase is as strong as a 3 word if the attacker uses the word list in the 'right' sequence.
I have not included single character and most 2 character combinations words in my Netherlands Diceware word list.
Dick99999 (talk) 18:14, 16 July 2014 (UTC)
replies: text: There are 7776 x 7776 = 60,466,176 possible word pairings in the Diceware list, so 2700 does not suggest a high collision likelihood, even with 5 or 6 opportunities per pass phrase. Still, I now suggest that users of Diceware put a space character between words, which eliminates the problem. That was the original intent, but when reports surfaced about password capture via  acoustic cryptanalysis, I suggested eliminating the spaces. It has since become clear that doing this will not defeat acoustic cryptanalysis and there are other methods available to someone who can access your keyboard or get close to where you are typing your pass phrase, e.g. key capture software, a bugged cable, and video surveillance. So I am back to recommending spaces, which is more natural when typing a string of words. It also reduces the susceptibility of short Diceware pass phrases to brute force letter-by-letter attack, which is likely the most common threat in the wild. (WP:COI note: I am owner of web site in question.)--agr (talk) 15:38, 24 July 2014 (UTC)
replies: text: Suppose I use the following scenario to attack the space insertion. I know which words collide with other words. Words like 'acton' formed by 2 words in sequence 'act' and 'on'. I put a space character between act and on. Then brute force that with and without the space. That will catch both: users inserting a space between the words and users that do not insert a space. This will just double the attack time, in stead of a factor 7776 if considered 2 non-colliding words. So it is almost like the strength of a pass phrase existing of one word less.
 Dick99999 (talk) 14:01, 30 July 2014 (UTC)

text: The formal weakness that the lack of spaces causes is a De Bruijn sequence.  This Stack overflow post talking about "password knocking" explains why its weaker in a way that might be more understandable than the more complex examples produced by Diceware, but fundamentally, it is the same. http://security.stackexchange.com/a/82102 Gaijin42 (talk) 21:55, 26 March 2015 (UTC)
thread_title:  Word list collisions