No. A passphrase constructed from 5 words /randomly selected/ from a 300k word dictionary has approximately 2.4 × 10²⁷ possibilities or 90 bits of security. Trying all combinations is effectively impossible. Even assuming you happen to know the exact dictionary that was used.
And, I would be shocked if the poem constraint takes off more than a few bits of freedom. (Only 1 in 128 words are compatible for your rhyming pair? That's 7 bits. Compensate for it in full by just adding one more word to the passphrase.)
But it's not random they specifically select sentences that form a poem that is valid in the English language and is easy to memorize.
If you apply other restrictions like knowing that the authentication mechanism only allows X number of characters and assuming that the user will attempt to come as close as possible to that max but cannot pass it obviously it allows you to reduce the amount of valid poems even further.
People who are good at password cracking and social engineering can often reduce the amount of possible passwords for a specific target to about 10,000 with quite high accuracy, this is less math and rocket science and more common sense and psychology in this case.
they specifically select sentences that form a poem that is valid in the English language
How many possible rhyming couplets are there? I'll give you a hint, it's a huge number.
and is easy to memorize.
They do this by choosing from a million candidates. That reduces the key space by log2(1000000) ~ 19.9 bits. Compensate in full by increasing the key size by two more words.
social engineering
Irrelevant. The passphrases are selected by computer.
Comments
No. A passphrase constructed from 5 words /randomly selected/ from a 300k word dictionary has approximately 2.4 × 10²⁷ possibilities or 90 bits of security. Trying all combinations is effectively impossible. Even assuming you happen to know the exact dictionary that was used.
And, I would be shocked if the poem constraint takes off more than a few bits of freedom. (Only 1 in 128 words are compatible for your rhyming pair? That's 7 bits. Compensate for it in full by just adding one more word to the passphrase.)
But it's not random they specifically select sentences that form a poem that is valid in the English language and is easy to memorize.
If you apply other restrictions like knowing that the authentication mechanism only allows X number of characters and assuming that the user will attempt to come as close as possible to that max but cannot pass it obviously it allows you to reduce the amount of valid poems even further.
People who are good at password cracking and social engineering can often reduce the amount of possible passwords for a specific target to about 10,000 with quite high accuracy, this is less math and rocket science and more common sense and psychology in this case.
How many possible rhyming couplets are there? I'll give you a hint, it's a huge number.
They do this by choosing from a million candidates. That reduces the key space by log2(1000000) ~ 19.9 bits. Compensate in full by increasing the key size by two more words.
Irrelevant. The passphrases are selected by computer.
Do the actual calculations.