sts10 / phraze

Generate random passphrases
https://sts10.github.io/2023/10/24/phraze-passphrase-generator.html
Mozilla Public License 2.0
24 stars 3 forks source link

Investigate feasibility of an "acrostic" option #23

Open sts10 opened 4 months ago

sts10 commented 4 months ago

I noticed that XKCD-password-generator has an option to generate a passphrase that matches an acrostic.

$ xkcdpass --count=5 --acrostic='chaos' --delimiter='|' --min=5 --max=6 --valid-chars='[a-z]'
> collar|highly|asset|ovoid|sultan
> caper|hangup|addle|oboist|scroll
> couple|honcho|abbot|obtain|simple
> cutler|hotly|aortae|outset|stool
> cradle|helot|axial|ordure|shale

I'm assuming this makes the passphrase easier to remember.

One reason I'm hesitant to start development of this feature for Phraze is that I'm not sure how to accurately estimate the entropy of a passphrase generator via this acrostic method. This issue describes some potential pitfalls in this calculation.

Clearly, the entropy calculations depends on whether the word that forms the acrostic is chosen by the user (as xkcdpass does) or chosen randomly by the program. The latter case would lead to a "stronger" passphrase and, mathematically, would be more interesting.