Date: Tue, 25 Sep 2018 22:00:43 -0400 From: John Roman <john@...1ce.com> To: passwdqc-users@...ts.openwall.com Subject: pwqgen vs diceware Greetings passwdqc mailing list, I'm certainly not here to start a flame war, but I had wondered casually which would be most suitable for a user generating a password: pwqgen, or diceware? what is the random dictionary used for pwqgen? are they similar? as pwqgen generated phrases increase in size, so to do they increase in difficulty to remember. this difficulty is bolstered by the strength imparted by pwqgens random inclusion of case, numerics, and specials. diceware offers high entropy passphrases at a low entry cost for the user, but is a shorter 3 word pwqgen passphrase just as strong as a longer 6 word passphrase from diceware? entropically they seem identical. pwqgwen offers greater possibility of acceptance from legacy password systems that take fewer than 30 characters, but increases the potential that a character might be suspect or unsupported. Diceware in turn can be adulterated with a case, numeric, or special as needed, but might see length issues. pwqgen states its capable of 24-85 for entropy. diceware seems to appreciate ~77 bits of entropy. ive been testing entropy from this page: http://rumkin.com/tools/password/passchk.php and here: https://www.rempe.us/diceware/#eff its worth noting rumkins calculation for entropy seems a little high...a 77 bit entropy phrase at diceware will yield a 200 entropy phrase, for example...I wonder too what the appropriate entropy calculation is? thanks for your help.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.