Pass phrase

Pass phrase

A passphrase is a collection of 'words' used for access control, typically used to gain access to a computer system. The words need not all be, but too often are, found in a language dictionary -- most particularly one available (on or off line) as input to a dictionary attack program. Alternatively, and very commonly, passphrases are used to control both access to, and operation of, special security programs such as cryptographic systems. The origin of the term is by analogy with "password".

Phil Zimmermann's popular crypto system PGP, for example, requires you to make up a passphrase that you enter whenever you sign or decrypt messages. So does the newer Internet standard (OpenPGP) compliant version, GPG. An Internet service called HushMail provides free encrypted e-mail service, but its security depends almost entirely on the quality of the passphrase you choose. You should have your passphrase ready before creating your PGP or GPG key or opening a new Hushmail account. 'Inventing' a passphrase while entering it is a poor practice, and very likely to lead to poor passphrases and so to poor security.

Passphrases differ from passwords. A password is usually short -- six to ten characters. Such passwords may be adequate for logging onto computer systems (if frequently changed, and if permitted passwords are not found in dictionaries, and if they are sufficiently long that brute force search attacks are impractical, and if ...), but they are certainly not safe for use with quality security systems (eg, encryption systems). Passphrases are a better choice. First, they usually are (and always should be) much longer -- 20 to 30 characters or more is typical, making brute force attacks entirely impractical. Second, if well chosen, they will not be found in any 'phrase dictionary', so dictionary attacks will be impossible. Third, they can be so structured as to be more easily rememberable without being written down, reducing that risk as well. They can be, thus, considerably more 'secure'. The modern concept of passphrases was invented by Sigmund N. Porter in 1982.

Picking a good passphrase is one of the most important things you can do to preserve the privacy of your computer data and e-mail messages. A passphrase should be:

Known only to you
Long enough to be hard to guess (eg, automatically, as from a list of famous phrases)
Hard to guess by intuition -- even by someone who knows you well
Easy for you to remember and type accurately

One reasonable way to create a passphrase is to use dice to select words at random from a long list (ideally, not just of words from a dictionary), a technique often referred to as diceware. On the other hand, such a collection of words will probably violate the last desiratum listed. There is no procedure known for picking a perfect passphrase.