1
$\begingroup$

Assume that I have a 24-word passphrase that I want to store securely but online by mixing it with another 24 words in a manner only I know. Does the checksum property somehow help an attacker to significantly speed up the process of guessing the right 24-word phrase in a reasonable time?

I would guess no because the attacker still needs to try an absurd number of combinations being somewhere in the vicinity of

$$ \binom{48}{24} \cdot 24! \approx 2 \cdot 10^{37}. $$

Edit: For clarifaction, I add a minimal example which led me to the above question. Let us consider the following simple passphrase system:

  1. Choose 3 distinct words from all words which can be set together by 3 letters (abc, god, ced, ....)
  2. The fourth word must fulfil that it contains the first letters of the three first words (that is meant to be a very simplified checksum condition)

Let us say I have the passphrase (ago, bro, sis, abs) and mix it with another passphrase (gro, lab, for, glf) to

(ago, glf, for, sis, abs, gro, lab, bro)

Now it is way faster to scan this sequence and check for which quadruple rule 2. applies to obtain the two possible valid pass phrases than just trying all $$ \binom{8}{4}\cdot 4! = 1680 $$ combinations.

$\endgroup$
7
  • $\begingroup$ Welcome to Cryptography.SE. What is exactly your question? What do you mean by mixing? Why do you want to store your password online? You need another password to recover that from a possibly encrypted version. $\endgroup$
    – kelalaka
    May 12 at 13:25
  • $\begingroup$ By mixing I mean: I take my ordered 24 words and some other 24 words and permutate them to obtain an ordered sequence of 48 words. Then I only store this 48 word sequence. If checksums wouldn't exist (i.e. the 24 word pass phrase would just be drawn uniformly at random from all such combinations), then there were 2*10^37 combinations making it practically impossible to brute force my initial pass phrase. My question is, if the fact that the last word in any valid pass phrase being restricted due to the checksum property makes it significantly easier to derive my pass phrase. $\endgroup$
    – lunskra
    May 12 at 14:38
  • $\begingroup$ What is the manner of the mixing then? $\endgroup$
    – kelalaka
    May 12 at 14:42
  • $\begingroup$ Let's say I choose a permutation of {1,...,48} uniformly at random and permute the 48 words in exactly that way. $\endgroup$
    – lunskra
    May 12 at 14:52
  • $\begingroup$ First of all, thank you very much for your effort! I think I have to formulate more clearly what I want to say :-): I want to find a way to memorize a 24 word passphrase with the least effort possible and without using any encryption. So my suggestion was to just store 48 words in which the passphrase is hidden in a way I can remember. For example, I could just permute the words such that all the even positions recover my passphrase. For an attacker who doesn't know my system this would look like a random permutation. Can this attacker derive from these 48 words my passphrase? $\endgroup$
    – lunskra
    May 12 at 15:29
0
$\begingroup$

The proposed method requires 24 additional random BIP-39 words. The additional words together with the real 24-word passphrase are permutated in a word manner. The result has $2\cdot 10^{37}$ combinations that have $\approx 2^{124}$ bits of security. 8-word passphrase are already had more security than this $\approx 2^{139}$[1]

If a random permutation is used to scramble the words there is another problem with the bit size of the permutation that one has to store. If we consider that each of the 48 words can be represented with 8 bits then one needs $48\cdot 6 = 288$ bits to store. This is already larger than the bits size of the AES-256 that we hard to memorize it so we use BIP-39 or DiceWire to keep our keys secure depending on the length of the key 128 or 256.

I want to find a way to memorize a 24 word passphrase with the least effort possible and without using any encryption. So my suggestion was to just store 48 words in which the passphrase is hidden in a way I can remember. For example, I could just permute the words such that all the even positions recover my passphrase. For an attacker who doesn't know my system this would look like a random permutation. Can this attacker derive from these 48 words my passphrase?

Your least effort possible way to memorize is not unique to you. Actually, this means that you are using less entropy for your permutation. The attackers, by knowing or with a clever thought, will first try this least effort permutations as done in the least effort passwords like 1234.

I will not consider your example even possible position or others, the above paragraph should be enough ( how do you recover the order of the even permutations).

Your idea

  1. Has less entropy than the 24-word passphrase 256 vs 124
  2. An attacker can recover your weak permutations if you are the target and they know your system and you!
  3. Humans are bad at random number generation [2] and you are shifting a secure system to your randomness that already shows the weakness.

If you already consider storing them consider using password managers so that you only need to store one really good BIP-39 or Dicewire and the rest of the passwords can be generated uniform randomly .

$\endgroup$
4
  • $\begingroup$ Thank you! 2. and 3. are really convincing. I seem to underestimate that however tricky the system I permute the words with is, it will never be unpredictable enough! $\endgroup$
    – lunskra
    May 12 at 15:59
  • $\begingroup$ Welcome. The password managers are really good at their job. $\endgroup$
    – kelalaka
    May 12 at 16:03
  • $\begingroup$ Do you know of any results regarding the theoretical question how long it takes to find the 24-word passphrase in the 48-word permutation with and without a passphrase system which has checksums? (like indicated in the example in my edit) $\endgroup$
    – lunskra
    May 12 at 16:03
  • $\begingroup$ No, I did not consider that since it already weakens the system. The checksum can enable the attacker to check the password before going to test on the target system. This will reduce the cost. That really need the parameters to be calculated. $\endgroup$
    – kelalaka
    May 12 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.