Please enlighten us on how to generate rainbow tables for passphrases. Assuming they use a lower bound of 6 bits per character, a 100 bit phrase is 46 characters long.
Off the top of my head, I'd use a book of quotations, popular lines from movies, etc. And try to hit common permutations of each. So there's a bit of low hanging fruit. But that could be detected when they generate their key.
Remember, salt doesn't really prevent anyone from using "password" or the first line of Billie Jean.
Assuming they were actually keeping the contents of such wordlists out and actually ensuring high-entropy passphrases, we would be in an OK place, though still far removed from the security provided by randomly seeded ECC keypairs.
And as an attacker, I'm using my rainbow tables specifically to target the low hanging fruit. It gives me the best initial odds, and also the best return on any given hit: I'm way more likely to get more users per match for things in the common phrasebook, by nature of it being the common phrasebook.
Assuming they were actually keeping the contents of such wordlists out and actually ensuring high-entropy passphrases, we would be in an OK place, though still far removed from the security provided by randomly seeded ECC keypairs.
I'm fairly skeptical of the ability of software to "ensure high-entropy passphrases". I don't think it's trivial to anticipate the entropy-lowering strategies that people will come up with in order to help them remember their passwords.
Anyway what will be easy to remember for a human will be sequences exhibiting high ngrams correlation, which is efficiently modeled by markov chains. Wondering if studies have been done from this perspective on password strength, and how chains generated from leaked password / passphrase collections would deviate from ones generated from common language.
I don't get your point with your link. It says it cannot detect certain repeated character runs, or the word "password" in Morse code.
Basically you're arguing against memorizing the key. That means users are forced to keep a file around. It ignores the many cases where you don't want to have to maintain a file.
Please enlighten us on how to generate rainbow tables for passphrases.
Pick P, the set of passwords, to be something like "4-6 dictionary words appended". Pick R, the reduction function, such that it maps from a hash to a random value in P.
Comments
Please enlighten us on how to generate rainbow tables for passphrases. Assuming they use a lower bound of 6 bits per character, a 100 bit phrase is 46 characters long.
Off the top of my head, I'd use a book of quotations, popular lines from movies, etc. And try to hit common permutations of each. So there's a bit of low hanging fruit. But that could be detected when they generate their key.
Remember, salt doesn't really prevent anyone from using "password" or the first line of Billie Jean.
Assuming they were actually keeping the contents of such wordlists out and actually ensuring high-entropy passphrases, we would be in an OK place, though still far removed from the security provided by randomly seeded ECC keypairs.
But that's not the case:
https://github.com/dropbox/zxcvbn/issues/39
And as an attacker, I'm using my rainbow tables specifically to target the low hanging fruit. It gives me the best initial odds, and also the best return on any given hit: I'm way more likely to get more users per match for things in the common phrasebook, by nature of it being the common phrasebook.
I'm fairly skeptical of the ability of software to "ensure high-entropy passphrases". I don't think it's trivial to anticipate the entropy-lowering strategies that people will come up with in order to help them remember their passwords.
That's my point.
Anyway what will be easy to remember for a human will be sequences exhibiting high ngrams correlation, which is efficiently modeled by markov chains. Wondering if studies have been done from this perspective on password strength, and how chains generated from leaked password / passphrase collections would deviate from ones generated from common language.
I don't get your point with your link. It says it cannot detect certain repeated character runs, or the word "password" in Morse code.
Basically you're arguing against memorizing the key. That means users are forced to keep a file around. It ignores the many cases where you don't want to have to maintain a file.
Pick P, the set of passwords, to be something like "4-6 dictionary words appended". Pick R, the reduction function, such that it maps from a hash to a random value in P.