Subject: [Cfrg] Word-lists for Diffie-Hellman and Fingerprints

From: Aaron Zauner <[email-masked]>
Date: Thu, 24 Aug 2017 19:32:10 +0200

Hi,

A recent Twitter discussion [0] prompted me to look up any IETF documents specifying "PGP word lists" [1] as in use for for short authentication strings (SAS) in ZRTP and e.g. Signal. Apparently there's no such document, nor any other document that concerns word-lists that humans can easily read, say and hear/comprehend. GPG implements the ICAO phonetic alphabet as a command line option (`--with-icao-spelling`). This is nice, but I'd rather have a key-signing party that sounds like drunk anthropologists than forward air controllers having fun.  I've considered a patch. As the OpenPGP WG has been "closed", I'm unsure where to take this topic to, but CFRG seems to be a good place to ask.

The original publication - as used in PGPfone - is here: http://www.mathcs.duq.edu/~juola/papers.d/icslp96.pdf

..obviously there may be different views on how such a word-list should look like and I'm seeking input from the crypto and UX community. I think a standard or BCP would be nice to have. Obviously word-lists are in use for DH without WebPKI already - even different ones, as far as I know - but it would make sense to have a discussion on the topic.

What's your opinion on the matter?

Aaron

[0] https://twitter.com/AaronToponce/status/900767850142380033
[1] https://en.wikipedia.org/wiki/PGP_word_list

---

From: Werner Koch <[email-masked]>
Date: Thu, 24 Aug 2017 22:25:55 +0200

> What's your opinion on the matter?

Word list are probably good for native speakers of a language but they
are problematic for non-native speakers and are useless for
non-speakers.

We had several discussions on that topic over the last decades and the
only solution we cam up with was to use the ICAO spelling.  It has the
advantage that not only aviation people know it but also a million or so
Hams.  For all other gpg has the --with-icao-spelling option ;-).

Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

---

From: Derek Atkins <[email-masked]>
Date: Fri, 25 Aug 2017 10:15:41 -0400

Hi,

Aaron Zauner <[email-masked]> writes:

> Hi,
>
> A recent Twitter discussion [0] prompted me to look up any IETF
> documents specifying "PGP word lists" [1] as in use for for short
> authentication strings (SAS) in ZRTP and e.g. Signal. Apparently
> there's no such document, nor any other document that concerns
> word-lists that humans can easily read, say and hear/comprehend. GPG
> implements the ICAO phonetic alphabet as a command line option
> (`--with-icao-spelling`). This is nice, but I'd rather have a
> key-signing party that sounds like drunk anthropologists than forward
> air controllers having fun.  I've considered a patch. As the OpenPGP
> WG has been "closed", I'm unsure where to take this topic to, but CFRG
> seems to be a good place to ask.

Have you looked at S/Key?  (RFC1760)?

It's not specific to PGP, but it does give a possible mapping.

-derek
-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Bill Cox <[email-masked]>
Date: Fri, 25 Aug 2017 11:13:38 -0700

Here's a 1024-long word list for English that I cooked up with a few hours
of work.  In short, the process for any language is:

- Find multiple lists of the most common words in the target language
- Throw away words that you feel are commonly misspelled. like forty (not
fourty).
- Throw away words with homophones, such as: to two too, dear deer, I eye,
hear here
- Throw away words with almost-homophones, such as: fifty fifteen

It has uses in password reset flows where a support person is trying to
help an employee who is at a loud airport using a cell phone.

The list could certainly be improved, but it is a good starting point for
English.

Bill

---

From: Tony Arcieri <[email-masked]>
Date: Fri, 25 Aug 2017 15:14:27 -0700

On Thu, Aug 24, 2017 at 10:32 AM, Aaron Zauner <[email-masked]> wrote:

> A recent Twitter discussion [0] prompted me to look up any IETF documents
> specifying "PGP word lists" [1] as in use for for short authentication
> strings (SAS) in ZRTP and e.g. Signal. Apparently there's no such document,
> nor any other document that concerns word-lists that humans can easily
> read, say and hear/comprehend.
>

I've found this to be an excellent resource for comparing various wordlists
and the quality of passwords or other authentication phrases generated from
them:

https://ae7.st/g/

> What's your opinion on the matter?

I am a big fan of this approach. See this video for some of my work
(warning: turn your wound down): https://www.youtube.com/watch?v=BAeJsskGHsQ

That said I'm not sure it's a CFRG-relevant topic...

> are problematic for non-native speakers and are useless for

The obvious (to me, at least) solution to this is language-localized
wordlists. It compounds the problem, and requires native speakers of each
language to curate good word lists, but I don't think the problem is
intractable.

-- 
Tony Arcieri

---

From: Gunnar Wolf <[email-masked]>
Date: Mon, 28 Aug 2017 17:48:55 -0500

Bill Cox dijo [Fri, Aug 25, 2017 at 11:13:38AM -0700]:
> (...)

...Of course, a sensible workflow whenever possible is just to stay
away from English for any uses that need to be the least bit phonetic.

---

From: Yoav Nir <[email-masked]>
Date: Wed, 30 Aug 2017 08:01:35 +0300

Why not re-use the list of words from appendix A of RFC 1751?

> On 25 Aug 2017, at 21:13, Bill Cox <[email-masked]> wrote:
> 
> Here's a 1024-long word list for English that I cooked up with a few hours of work.  In short, the process for any language is:
> 
> - Throw away words that you feel are commonly misspelled. like forty (not fourty).
> - Throw away words with homophones, such as: to two too, dear deer, I eye, hear here
> It has uses in password reset flows where a support person is trying to help an employee who is at a loud airport using a cell phone.
> 
> The list could certainly be improved, but it is a good starting point for English.
> 
> Bill
> <words>_______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

---

From: Tony Arcieri <[email-masked]>
Date: Tue, 29 Aug 2017 22:24:00 -0700

> Why not re-use the list of words from appendix A of RFC 1751?

I can't give a concrete answer, however as someone who's a bit obsessive
about comparing various wordlists, granted in an entirely ad hoc way of
generating random samples and making a more or less ad hoc judgement about
how often I was presented random samples I liked, I really like the EFF's
(English) wordlist, and am not a super big fan of RFC 1751. Granted that's
a completely non-quantitative opinion, more like one based in aesthetics.
I'm sure YMMV...

-- 
Tony Arcieri