phc-discussions - Re: [PHC] CJK character sets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <212930599.20131127215846@gmail.com>
Date: Wed, 27 Nov 2013 21:58:46 +0100
From: Krisztián Pintér <pinterkr@...il.com>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] CJK character sets

remembering 8 idiograms is identical to remembering 8 words. it is
perfectly doable, although most people just does not want to do it. an
english word typically has the entropy of around 11-12 bits,
which is identical to 2000-4000 idiograms. it is not a surprise, words
are words, some languages has a little more, some a little less, but
not that much different.

typing idiograms requires 2-3 button presses, and that is a great
advantage over typing the entire word. but with the caveat that most
interfaces help with the options, so you don't have to remember the
combinations. this is of course unacceptable with passwords.

so i would say, chinese are not at an advantage, even if the system is
designed around idiograms.

but it points into the direction, which i think is right, of using
random words as passwords, and possibly having a system to shorten
them to save typing. it is more human than remembering characters. (i
hope everyone knows the obligatory xkcd: http://xkcd.com/936/ )

Marsh Ray (at Wednesday, November 27, 2013, 9:17:44 PM):

> Having fluency in an alphabet orders of magnitude larger than our
> tiny Western alphabets surely changes the password strength problem.
> I would expect that it would make it easier to create and remember
> strong entropy. A short 8-character  password in a Western script
> could perhaps be more like a pass phrase in Chinese-based script.