I recently investigated best-practices in regards to passwords, and the overwhelming majority of sources recommended using a password manager. This is great advice, but not usable in every situation. Certain situations, such as OS login, Disk Decryption or Password Manager unlocks do not allow me to let a password manager "type my password in for me".

As such, I have looked at the second-best alternative, which seems to be Diceware and Passphrases. What had me stumped was this answer of a related question, which hinted that Diceware was superior. An excerpt from the answer:

Passphrases are great (Diceware is better) for locking password managers, [...]

^{Emphasis mine}

What confuses me is why this claim that Diceware is supposedly superior? I used zxcvbn to compare the strength of the two example passwords below and it seemed as if the passphrase was more secure than the Diceware password. Further, the Passphrase generates a visual image, although nonsensical, which is easy to remember. The only disadvantage I can imagine is that the passphrase takes longer to type, which is a marginal disadvantage considering it would only need to be typed once before a password manager can be used again.

Examples

Diceware

Diceware is the process of rolling a set of dice, which would indicate a random word from a pre-defined list. Depending on the desired security, more words are chosen.

An example outcome of a Diceware process might be the password:

cleft cam synod lacy yr wok

Passphrases

A passphrase is in essence a sentence, which make sense to the user and hopefully nobody else. It might make grammatical sense, but is very unlikely to make semantic sense.

An example of a passphrase would be:

Blue Light shines from the small Bunny onto the Lake.

Most people that use passphrases, use passphrases wrong.

The remark that Dicware is better probably comes from the fact that, when people use passphrases, they usually take a well-known or otherwise logically structured sentence and use that. "Mary had a little lamb" a terrible passphrase because it is one of a few billion well-known phrases that a computer can run through in a short amount of time. I know this works pretty well because I tried it.

Diceware is just random words. It's as good as any other randomly generated set of words, assuming you use a good source of randomness: for Diceware, you should use dice, which is a reasonably good source. Digital password generators are usually also good, though homebrew implementations might use an insecure random generator by mistake.

We know that any random passphrase is good because it's basic math. There are two properties to a passphrase:

• Dictionary size


• Number of words in the phrase

The 'randomness' of a passphrase is simple to calculate: dictionary_size ^ words_in_phrase, where ^ is exponentiation. A passphrase of 3 words with a dictionary of 8000 words is 8000^3= 512 billion possible phrases. So an attacker, when guessing the phrase, would have to try 256 billion phrases (on average) before s/he gets it right. To compare with a password of similar strength: a random password using 6 characters, consisting of a-z and A-Z, has a "dictionary size" of 52 (26 + 26) and a "number of words" of 7, making 52^6= ~1028 billion possible passwords. It is well-known that 7 characters is pretty insecure, even when randomly generated.

For randomness, it's the more the better up until about 128 bits of entropy. A little more than that helps buffer against cryptographic weakenings of algorithms, but really, you don't want to memorize 128 bits of entropy anyway. Let's say we want to go for 80 bits of entropy, which is a good compromise for almost anything.

To convert "number of possible values" to "bits of entropy", we need to use this formula: log(n)/log(2), where n is the number of possible values. So if you have 26 possible values (1 letter), that would be log(26)/log(2)= ~4.7 bits of entropy. That makes sense because you need 5 bits to store a letter: the number 26 is 11010 in binary.

A dictionary of 8000 words needs about 7 words to get above the desired 80 bits:
log(8000^7)/log(2)= ~90.8 bits of entropy. Six words would be:
log(8000^6)/log(2)= ~77.8 bits of entropy.

A large dictionary helps a lot, compared to the relatively small Diceware dictionary of 7776 words. The Oxford English Dictionary has 600k words. With that many words, a phrase of four randomly chosen words is almost enough:
log(600 000^4)/log(2)= ~76.8 bits of entropy.

But at 600 thousand words, that includes very obscure and long words. A dictionary with words that you can reasonably remember might have a hundred thousand or so. Instead of the seven words that we need with Diceware, we need five words in our phrase when selecting randomly from a dictionary of 100k words:
log(100 000^5)/log(2)= ~83.0 bits of entropy.

Adding one more word to your phrase helps more than adding ten thousand words to your dictionary, so length beats complexity, but a good solution balances the two. Diceware seems a little small to me, but perhaps they tested with different sizes and found this to be a good balance. I am not a linguist :).

Just for comparison, a password (consisting of a-z, A-Z, and 0-9) needs 14 characters to reach the same strength: log(62^14)/log(2)= ~83.4 bits of entropy.

Passwords should be easy to remember and hard to guess. As AviD once said, security at the expense of usability, comes at the expense of security. A passphrase is easy to remember because it has some sort of meaning to the user, even though it might seem random at first. Taking a look at usability, a passphrase is more superior: You don't need dice and a list of words, you can think of a passphrase yourself and remember it more easily.

However, using dice and a random list of words makes for a near fully random password. There is no link to the user, where a passphrase most of the times (unless truly random) was made up of something related to the user.

Any password checker online can only verify how hard it would be for a computer to guess a password, where a sentence (or passphrase in this case) might be more easily guessed by another human. In your example, the length of your diceware generated password is less then the passphrase (however still very long compared to security standards nowadays), but as you stated yourself, you can create longer passwords when you want to.

I wouldn't say diceware is always superior, but it definitely is more random and can still have the same length as a passphrase which makes it superior in certain cases.