Educause Security Discussion mailing list archives

Re: Password entropy


From: Paul Russell <prussell () ND EDU>
Date: Sun, 23 Jul 2006 22:07:19 -0400

On 7/23/2006 16:52, Valdis Kletnieks wrote:

If we had keyboards and brains and systems that accepted Chinese characters
that represent words as single characters, an 8-word passphrase would be
as long and nearly as strong as an 8-character random password.  The reason
the passphrase has to be longer is because you get much less randomness
and entropy *per character* in a Latin-charset passphrase...


Much of this discussion seems to have focused on the lack of entropy in
English-language words and phrases. Both suffer from the predictability of
letter sequences. Does entropy increase if the 'word' consists of the first
(or last) letters of a phrase? Does it increase further if non-alphabetic
characters are substituted for letters?

--
Paul Russell, Senior Systems Administrator
OIT Messaging Services Team
University of Notre Dame
prussell () nd edu

Current thread: