Benefit of capitalization when using Diceware passphrases?

Question

If I use a Diceware generated passphrase of any given length, will capitalizing the first word (or any word for that matter) effectively double the number of combinations that would have to be tried in a brute force attack. In other words by capitalizing one word of the passphrase chosen from a list of ~7500 words haven't I now created a single list of ~15K words: abc, def … xyz, Abc, Def … Xyz.

Even if I told an attacker which word list I used and that I capitalized the very first word of the passphrase, wouldn't the random nature of the dice throw create a larger space to search through before a successful guess?

Answer 1

Yes, randomly choosing whether or not to capitalize the first word in the passphrase doubles the number of possible passphrases, and thus also doubles the average time needed for a brute force attacker to guess the correct passphrase.

Note that doubling the average time needed to crack the passphrase is equivalent to increasing the entropy of the passphrase by one bit. In comparison, adding one more word to your Diceware passphrase will increase its entropy by 5 log₂(6) ≈ 12.9 bits, multiplying the average time needed to crack it by 6⁵ = 7776.

---

Of course, there are several other capitalization choices one could more or less reasonably make, such as:

• all lower case,
• ALL UPPER CASE,
• Title Case (First Letter Of Every Word Capitalized),
• LeEt CaSe (EvErY sEcOnD lEtTeR cApItAlIzEd),
• reversE titlE caseE,
• tITLE cASE wITH cAPS lOCK oN,
• Only first letter capitalized,
• oNLY FIRST LETTER IN LOWER CASE, etc.

Choosing randomly from among, say, the eight capitalization options above would make the passphrase eight times harder to guess, increasing its entropy by log₂(8) = 3 bits. You could also randomly decide e.g. whether or not to use spaces between the words in your passphrase, again doubling the average time to guess it and increasing the entropy by one bit. And including the possibility of using, say, hyphens or periods or underscores instead of the spaces would add a bit or two more entropy yet.

That's still a lot less than just making the passphrase one word longer, though. To achieve a comparable increase in entropy, you've have to literally choose the capitalization and punctuation of your passphrase randomly from among almost eight thousand options. Good luck remembering that!