diceware

Passphrases to remember...

|bdg-tests| |

documentation 

sources 

issues 

.. |bdg-tests| image:: https://github.com/ulif/diceware/actions/workflows/tests.yml/badge.svg?branch=master :target: https://github.com/ulif/diceware/actions/workflows/tests.yml :alt: Test Status

.. |bdg-last-release| image:: https://img.shields.io/pypi/v/diceware.svg :target: https://pypi.python.org/pypi/diceware/ :alt: Latest Release

.. |bdg-versions| image:: https://img.shields.io/pypi/pyversions/diceware.svg :target: https://pypi.python.org/pypi/diceware/ :alt: Supported Python Versions

.. |bdg-license| image:: https://img.shields.io/pypi/l/diceware.svg :target: https://pypi.python.org/pypi/diceware/ :alt: License

.. |doc-status| image:: https://readthedocs.io/projects/diceware/badge/?version=latest :target: https://diceware.readthedocs.io/en/latest/ :alt: Documentation Status

diceware

$ diceware MyraPend93rdSixthEagleAid

The passphrase contains by default six words (with first char capitalized) without any separator chars. Optionally you can let

diceware

diceware

.. contents::

Install

This Python package can be installed via pip_::

$ pip install diceware

The exact way depends on your operating system.

Usage

Once installed, use

--help

$ diceware --help usage: diceware [-h] [-n NUM] [-c | --no-caps] [-s NUM] [-d DELIMITER] [-r SOURCE] [-w [NAME [NAME ...]]] [--dice-sides N] [-v] [--version] [INFILE]

Create a passphrase

positional arguments: INFILE Input wordlist. `-' will read from stdin.

optional arguments: -h, --help show this help message and exit -n NUM, --num NUM number of words to concatenate. Default: 6 -c, --caps Capitalize words. This is the default. --no-caps Turn off capitalization. -s NUM, --specials NUM Insert NUM special chars into generated word. -d DELIMITER, --delimiter DELIMITER Separate words by DELIMITER. Empty string by default. -r SOURCE, --randomsource SOURCE Get randomness from this source. Possible values:

realdice',

de',

en_eff',

en_orig',

Arguments related to `realdice' randomsource: --dice-sides N Number of sides of dice. Default: 6

Wordlists are stored in

With

-n

$ diceware -n 1 Thud

$ diceware -n 2 KnitMargo

You can

diceware

-s

$ diceware -s 2 Heroic%unkLon#DmLewJohns

Here

"%"

"#"

Special chars are taken from the following list::

~!#$%^&*()-=+[]{}:;\"'<>?/0123456789

Please note that several special chars might replace the same original char, resulting in a passphrase with less special chars than requested.

With

-d

diceware

$ diceware -d "" WavyBaden400WhelpQuestMacon

By default we use the empty string as delimiter, which is good for copying via double click on Linux systems. But other delimiters might make your passphrases more readable (and more secure, see

Security Traps 

By default the single phrase words are capitalized, i.e. the first char of each word is made uppercase. This does not necessarily give better entropy (but protects against entropy loss due to non

prefix
code

Security Traps 

You can nevertheless disable caps with the

--no-caps

$ diceware --no-caps oceanblendbaronferrylistenvalet

This will leave the input words untouched (upper-case stays upper-case, lower-case stays lower-case). It does not mean, that all output words will be lower-case (except if all words of your wordlist are lowercase).

As the default lists of

diceware

--no-caps

diceware

-r 

--randomsource 

--help

By default we use the

random.SystemRandom

$ diceware -r realdice --dice-sides 6 Please roll 5 dice (or a single dice 5 times). Enter your 5 dice results, separated by spaces: 6 4 2 3 1 Please roll 5 dice (or a single dice 5 times). Enter your 5 dice results, separated by spaces: 5 4 3 6 2 ... UnleveledSimilarlyBackboardMurkyOasisReplay

Normally dice have six sides. And this is also the default in

diceware

--dice-sides

We support even sources of randomness from other packages. See the

documentation 

diceware

Additionally

diceware

@heartsucker

Both the original and 8k diceware wordlists by Mr. Reinhold are provided. You can enable a certain (installed) wordlist with the

-w

$ diceware --wordlist en_orig YorkNodePrickEchoToriNiobe

See

diceware --help

You can also build phrases from adjectives and nouns (yet in english only) using the included

en_adjectives

en_nouns

$ diceware -n 1 -w enadjectives ennouns TediousPerimeter

These adjective/noun phrases might be easier to memorize.

If you do not like the wordlists provided, you can use your own one. Any

INFILE

$ echo -e "hi\nhello\n" > mywordlist.txt $ diceware mywordlist.txt HelloHelloHiHiHiHello

With dash (

-

$ echo -e "hi\nhello\n" | diceware - HiHiHelloHiHiHello

In custom wordlists we take each line for a valid word and ignore empty lines (i.e. lines containing whitespace characters only). Oh, and we handle even PGP-signed wordlists.

You can set customized default values in a configuration file

.diceware.ini

[diceware] num = 7 caps = off specials = 2 delimiter = "MYDELIMITER" randomsource = "system" wordlist = "en_securedrop"

The options names have to match long argument names, as output by

--help

[diceware]

What is it good for?

Normally,

diceware

diceware

xkcd

.. image:: http://imgs.xkcd.com/comics/password_strength.png :align: center :target: http://xkcd.com/936/

.. _xkcd: http://xkcd.com/ .. _proof: http://xkcd.com/936/

The standard english wordlist of this

diceware

Joseph Bonneau

The special chars replacing chars of the originally created passphrase give some more entropy (the more chars you have, the more additional entropy), but not much. For instance, for a sixteen chars phrase you have sixteen possibilities to place one of the 36 special chars. That makes 36 x 16 possibilities or an entropy of about 9.17 you can add. To get an entropy increase of at least 10 bits, you have to put a special char in a phrase with at least 29 chars (while at the same time an additional word would give you 13 bits of extra entropy). Therefore you might think again about using special chars in your passphrase.

Is it secure?

The security level provided by Diceware_ depends heavily on your source of random. If the delivered randomness is good, then your passphrases will be very strong. If instead someone can foresee the numbers generated by a random number generator, your passphrases will be surprisingly weak.

This Python implementation uses (by default) the

random.SystemRandom

/dev/urandom

The Python API of this package allows usage of other sources of randomness when generating passphrases. This includes real dice. See the

-r

.. _sec-traps:

Security Traps

There are issues that might reduce the entropy of the passphrase generated. One of them is the

prefix code

Prefix Code ...........

If the wordlist contains, for example, the words::

"air", "airport", "portable", "able"

and we switched off caps and delimiter chars, then

diceware

"airportable"

which could come from

air-portable

airport-able

To avoid that, you can leave caps enabled (the default), use any word delimiter except the empty string or use the

en_eff

prefix code

pt-br

prefix code

Each of these measures is sufficient to protect you against the

prefix code

Reduced Entropy ...............

Overall,

diceware

This, however, is not possible, if the number of wordlist entries is not a power of dice sides. In that case we cut some words of the wordlist and inform the user about the matter. Reducing the number of words this way makes it easier for attackers to guess the phrase picked.

You can fix that problem by using longer wordlists.

Developer Install

Developers want to

fork me on github

$ git clone https://github.com/ulif/diceware.git

We recommend to create and activate a virtualenv_ first::

$ cd diceware/ $ virtualenv -p /usr/bin/python3.4 py34 $ source py34/bin/activate (py34) $

We support Python versions 2.6, 2.7, 3.3 to 3.7, and pypy.

Now you can create the devel environment::

(py34) $ python setup.py dev

This will fetch test packages (py.test_). You should be able to run tests now::

(py34) $ py.test

If you have also different Python versions installed you can use tox_ for using them all for testing::

(py34) $ pip install tox # only once (py34) $ tox

Should run tests in all supported Python versions.

Documentation Install .....................

The docs can be generated with Sphinx_. The needed packages are installed via::

(py34) $ python setup.py docs

To create HTML you have to go to the

docs/

Makefile

(py34) $ cd docs/ (py34) $ make

This should generate the docs in

docs/_build/html/

Creating the Man Page .....................

We provide a

ReStructuredTexT

Sphinx

(py34) $ rst2man.py docs/manpage.rst > diceware.1

The template is mainly provided to ease the job of Debian maintainers. Currently, it is not automatically updated. Dates, authors, synopsis, etc. have to be updated manually. Information in the manpage may therefore be wrong, outdated, or simply misleading.

Credits

Arnold G. Reinhold deserves all merits for the working parts of

Diceware

People that helped spotting bugs, providing solutions, etc.:

• Conor Schaefer (conorsch) 

  _
• Rodolfo Gouveia suggested to activate the

  --delimiter

  option.

• @drebs

  _ provided patches and discussion for different sources of randomness and the excellent

  pt-br

  wordlist.

  @drebs

  _ also initiated and performed the packaging of

  diceware

  for the

  Debian

  _ platform. Many kudos for this work!

  @drebs

  _ is also the official Debian maintainer of the

  diceware

  package.

• @heartsucker

  _ hand-compiled and added a new english wordlist.

• dwcoder 

  _ revealed and fixed bugs #19, #21, #23. Also showed sound knowledge of (theoretical) entropy. A pleasure to work with.

• George V. Reilly 

  _ pointed to new EFF wordlists.

• lieryan 

  _ brought up the

  prefix
  code

  _ problem.

• LogosOfJ 

  _ discovered and fixed serious

  realdice

  source of randomness problem.

• Bhavin Gandhi 

  _ fixed the confusing error message when an invalid input filename is given.

• Simon Fondrie-Teitler 

  _ contributed a machine-readable copyright file, with improvements from

  @anarcat

  _

• Doug Muth 

  _ fixed formatting in docs.

Many thanks to all of them!

Links

• The Diceware_ home page. Reading definitely recommended!

• fork me on github

  _

External Wordlists:

• Diceware standard list

  _ by Arnold G. Reinhold.

• Diceware8k list

  _ by Arnold G. Reinhold.

• Diceware SecureDrop list

  _ by

  @heartsucker

  _.

• EFF large list

  _ provided by EFF_.

• English adjectives and nouns lists

  _ provided by

  NaturalLanguagePasswords

  _.

License

This Python implementation of Diceware, (C) 2015-2019 Uli Fouquet, is licensed under the GPL v3+. See file LICENSE for details.

"Diceware" is a trademark of Arnold G Reinhold, used with permission.

The copyright for the

Diceware8k list

Diceware SecureDrop list

@heartsucker

EFF large list

Joseph Bonneau

@drebs

NaturalLanguagePasswords

.. pip: https://pip.pypa.io/en/latest/ .. _

@anarcat

Debian

Diceware

Diceware standard list

Diceware SecureDrop list

Diceware8k list

@drebs

EFF

EFF large list

English adjectives and nouns lists

fork me on github

@heartsucker

Joseph Bonneau

NaturalLanguagePasswords

prefix code

random.SystemRandom