Re: [Cfrg] Word-lists for Diffie-Hellman and Fingerprints

[Tony Arcieri <[e-mail]>]

On Thu, Aug 24, 2017 at 10:32 AM, Aaron Zauner <[e-mail]> wrote:

> A recent Twitter discussion [0] prompted me to look up any IETF documents
> specifying "PGP word lists" [1] as in use for for short authentication
> strings (SAS) in ZRTP and e.g. Signal. Apparently there's no such document,
> nor any other document that concerns word-lists that humans can easily
> read, say and hear/comprehend.
>

I've found this to be an excellent resource for comparing various wordlists
and the quality of passwords or other authentication phrases generated from
them:

https://ae7.st/g/


> What's your opinion on the matter?


I am a big fan of this approach. See this video for some of my work
(warning: turn your wound down): https://www.youtube.com/watch?v=BAeJsskGHsQ

That said I'm not sure it's a CFRG-relevant topic...

On Thu, Aug 24, 2017 at 1:25 PM, Werner Koch <[e-mail]> wrote:

> Word list are probably good for native speakers of a language but they
> are problematic for non-native speakers and are useless for
> non-speakers.


The obvious (to me, at least) solution to this is language-localized
wordlists. It compounds the problem, and requires native speakers of each
language to curate good word lists, but I don't think the problem is
intractable.

-- 
Tony Arcieri