The PGP Word List ("Pretty Good Privacy word list", also called a biometric word list for reasons explained below) is a list of words for conveying data bytes in a clear unambiguous way via a voice channel. They are analogous in purpose to the NATO phonetic alphabet used by pilots, except a longer list of words is used, each word corresponding to one of the 256 distinct numeric byte values.

History and structure

The PGP Word List was designed in 1995 by Patrick Juola, a computational linguist, and Philip Zimmermann, creator of PGP.[1][2] The words were carefully chosen for their phonetic distinctiveness, using genetic algorithms to select lists of words that had optimum separations in phoneme space. The candidate word lists were randomly drawn from Grady Ward's Moby Pronunciator list as raw material for the search, successively refined by the genetic algorithms. The automated search converged to an optimized solution in about 40 hours on a DEC Alpha, a particularly fast machine in that era.

The Zimmermann–Juola list was originally designed to be used in PGPfone, a secure VoIP application, to allow the two parties to verbally compare a short authentication string to detect a man-in-the-middle attack (MiTM). It was called a biometric word list because the authentication depended on the two human users recognizing each other's distinct voices as they read and compared the words over the voice channel, binding the identity of the speaker with the words, which helped protect against the MiTM attack. The list can be used in many other situations where a biometric binding of identity is not needed, so calling it a biometric word list may be imprecise. Later, it was used in PGP to compare and verify PGP public key fingerprints over a voice channel. This is known in PGP applications as the "biometric" representation. When it was applied to PGP, the list of words was further refined, with contributions by Jon Callas. More recently, it has been used in Zfone and the ZRTP protocol, the successor to PGPfone.

The list is actually composed of two lists, each containing 256 phonetically distinct words, in which each word represents a different byte value between 0 and 255. Two lists are used because reading aloud long random sequences of human words usually risks three kinds of errors: 1) transposition of two consecutive words, 2) duplicate words, or 3) omitted words. To detect all three kinds of errors, the two lists are used alternately for the even-offset bytes and the odd-offset bytes in the byte sequence. Each byte value is actually represented by two different words, depending on whether that byte appears at an even or an odd offset from the beginning of the byte sequence. The two lists are readily distinguished by the number of syllables; the even list has words of two syllables, the odd list has three. The two lists have a maximum word length of 9 and 11 letters, respectively. Using a two-list scheme was suggested by Zhahai Stewart.

Word lists

Here are the two lists of words as presented in the PGPfone Owner's Manual.[3]

HexEven WordOdd Word
00aardvarkadroitness
01absurdadviser
02accrueaftermath
03acmeaggregate
04adriftalkali
05adultalmighty
06afflictamulet
07aheadamusement
08aimlessantenna
09Algolapplicant
0AallowApollo
0Balonearmistice
0Cammoarticle
0Dancientasteroid
0EappleAtlantic
0Fartistatmosphere
10assumeautopsy
11AthensBabylon
12atlasbackwater
13Aztecbarbecue
14baboonbelowground
15backfieldbifocals
16backwardbodyguard
17banjobookseller
18beamingborderline
19bedlampbottomless
1AbeehiveBradbury
1Bbeeswaxbravado
1CbefriendBrazilian
1DBelfastbreakaway
1EberserkBurlington
1Fbilliardbusinessman
20bisonbutterfat
21blackjackCamelot
22blockadecandidate
23blowtorchcannonball
24bluebirdCapricorn
25bombastcaravan
26bookshelfcaretaker
27brackishcelebrate
28breadlinecellulose
29breakupcertify
2Abrickyardchambermaid
2BbriefcaseCherokee
2CBurbankChicago
2Dbuttonclergyman
2Ebuzzardcoherence
2Fcementcombustion
30chairliftcommando
31chattercompany
32checkupcomponent
33chiselconcurrent
34chokingconfidence
35chopperconformist
36Christmascongregate
37clamshellconsensus
38classicconsulting
39classroomcorporate
3Acleanupcorrosion
3Bclockworkcouncilman
3Ccobracrossover
3Dcommencecrucifix
3Econcertcumbersome
3Fcowbellcustomer
HexEven WordOdd Word
40crackdownDakota
41crankydecadence
42crowfootDecember
43crucialdecimal
44crumpleddesigning
45crusadedetector
46cubicdetergent
47dashboarddetermine
48deadboltdictator
49deckhanddinosaur
4Adogsleddirection
4Bdragnetdisable
4Cdrainagedisbelief
4Ddreadfuldisruptive
4Edrifterdistortion
4Fdropperdocument
50drumbeatembezzle
51drunkenenchanting
52Dupontenrollment
53dwellingenterprise
54eatingequation
55edictequipment
56eggheadescapade
57eightballEskimo
58endorseeveryday
59endowexamine
5Aenlistexistence
5Beraseexodus
5Cescapefascinate
5Dexceedfilament
5Eeyeglassfinicky
5Feyetoothforever
60facialfortitude
61falloutfrequency
62flagpolegadgetry
63flatfootGalveston
64flytrapgetaway
65fractureglossary
66frameworkgossamer
67freedomgraduate
68frightengravity
69gazelleguitarist
6AGeigerhamburger
6BglitterHamilton
6Cglucosehandiwork
6Dgoggleshazardous
6Egoldfishheadwaters
6Fgremlinhemisphere
70guidancehesitate
71hamlethideaway
72highchairholiness
73hockeyhurricane
74indoorshydraulic
75indulgeimpartial
76inverseimpetus
77involveinception
78islandindigo
79jawboneinertia
7Akeyboardinfancy
7Bkickoffinferno
7Ckiwiinformant
7Dklaxoninsincere
7Elocaleinsurgent
7Flockupintegrate
HexEven WordOdd Word
80meritintention
81minnowinventive
82miserIstanbul
83MohawkJamaica
84muralJupiter
85musicleprosy
86necklaceletterhead
87Neptuneliberty
88newbornmaritime
89nightbirdmatchmaker
8AOaklandmaverick
8BobtuseMedusa
8Coffloadmegaton
8Dopticmicroscope
8Eorcamicrowave
8Fpaydaymidsummer
90peachymillionaire
91pheasantmiracle
92physiquemisnomer
93playhousemolasses
94Plutomolecule
95precludeMontana
96prefermonument
97preshrunkmosquito
98printernarrative
99prowlernebula
9Apupilnewsletter
9BpuppyNorwegian
9CpythonOctober
9DquadrantOhio
9Equiveronlooker
9Fquotaopulent
A0ragtimeOrlando
A1ratchetoutfielder
A2rebirthPacific
A3reformpandemic
A4regainPandora
A5reindeerpaperweight
A6rematchparagon
A7repayparagraph
A8retouchparamount
A9revengepassenger
AArewardpedigree
ABrhythmPegasus
ACribcagepenetrate
ADringboltperceptive
AErobustperformance
AFrockerpharmacy
B0ruffledphonetic
B1sailboatphotograph
B2sawdustpioneer
B3scallionpocketful
B4scenicpoliteness
B5scorecardpositive
B6Scotlandpotato
B7seabirdprocessor
B8selectprovincial
B9sentenceproximate
BAshadowpuberty
BBshamrockpublisher
BCshowgirlpyramid
BDskullcapquantity
BEskydiveracketeer
BFslingshotrebellion
HexEven WordOdd Word
C0slowdownrecipe
C1snaplinerecover
C2snapshotrepellent
C3snowcapreplica
C4snowslidereproduce
C5soloresistor
C6southwardresponsive
C7soybeanretraction
C8spanielretrieval
C9spearheadretrospect
CAspellbindrevenue
CBspheroidrevival
CCspigotrevolver
CDspindlesandalwood
CEspyglasssardonic
CFstagehandSaturday
D0stagnatesavagery
D1stairwayscavenger
D2standardsensation
D3staplersociable
D4steamshipsouvenir
D5sterlingspecialist
D6stockmanspeculate
D7stopwatchstethoscope
D8stormystupendous
D9sugarsupportive
DAsurmountsurrender
DBsuspensesuspicious
DCsweatbandsympathy
DDsweltertambourine
DEtacticstelephone
DFtalontherapist
E0tapewormtobacco
E1tempesttolerance
E2tigertomorrow
E3tissuetorpedo
E4tonictradition
E5topmosttravesty
E6trackertrombonist
E7transittruncated
E8traumatypewriter
E9treadmillultimate
EATrojanundaunted
EBtroubleunderfoot
ECtumorunicorn
EDtunnelunify
EEtycoonuniverse
EFuncutunravel
F0unearthupcoming
F1unwindvacancy
F2uprootvagabond
F3upsetvertigo
F4upshotVirginia
F5vaporvisitor
F6villagevocalist
F7virusvoyager
F8Vulcanwarranty
F9waffleWaterloo
FAwalletwhimsical
FBwatchwordWichita
FCwaysideWilmington
FDwillowWyoming
FEwoodlarkyesteryear
FFZuluYucatan

Examples

Each byte in a bytestring is encoded as a single word. A sequence of bytes is rendered in network byte order, from left to right. For example, the leftmost (i.e. byte 0) is considered "even" and is encoded using the PGP Even Word table. The next byte to the right (i.e. byte 1) is considered "odd" and is encoded using the PGP Odd Word table. This process repeats until all bytes are encoded. Thus, "E582" produces "topmost Istanbul", whereas "82E5" produces "miser travesty".

A PGP public key fingerprint that displayed in hexadecimal as

E582 94F2 E9A2 2748 6E8B
061B 31CC 528F D7FA 3F19

would display in PGP Words (the "biometric" fingerprint) as

topmost Istanbul Pluto vagabond treadmill Pacific brackish dictator goldfish Medusa
afflict bravado chatter revolver Dupont midsummer stopwatch whimsical cowbell bottomless

The order of bytes in a bytestring depends on endianness.

Other word lists for data

There are several other word lists for conveying data in a clear unambiguous way via a voice channel:

  • the NATO phonetic alphabet maps individual letters and digits to individual words
  • the S/KEY system maps 64 bit numbers to 6 short words of 1 to 4 characters each from a publicly accessible 2048-word dictionary. The same dictionary is used in RFC 1760 and RFC 2289.
  • the Diceware system maps five base-6 random digits (almost 13 bits of entropy) to a word from a dictionary of 7,776 distinct words.
  • FIPS 181: Automated Password Generator converts random numbers into somewhat pronounceable "words".
  • mnemonic encoding converts 32 bits of data into 3 words from a vocabulary of 1626 words.[5]
  • what3words encodes geographic coordinates in 3 dictionary words.
  • the BIP39 standard permits encoding a cryptographic key of fixed size (128 or 256 bits, usually the unencrypted master key of a Cryptocurrency wallet) into a short sequence of readable words known as the seed phrase, for the purpose of storing the key offline. This is used in cryptocurrencies such as Bitcoin or Monero.
  • Like the PGP word list, the Bytewords standard maps each possible byte to a word. There is only one list, rather than two. The words are uniformly four letters long and can be uniquely identified by their first and last letters

References

This article incorporates material that is copyrighted by PGP Corporation and has been licensed under the GNU Free Documentation License. (per Jon Callas, CTO, CSO PGP Corporation, 4-Jan-2007)
  1. Juola, Patrick; Zimmermann, Philip (1996). "Whole-word phonetic distances and the PGPfone alphabet" (PDF). Proceeding of Fourth International Conference on Spoken Language Processing. ICSLP '96. Vol. 1. pp. 98–101. doi:10.1109/ICSLP.1996.607046. ISBN 0-7803-3555-4. S2CID 10385500.
  2. Juola, Patrick (1996). "Isolated Word Confusion Metrics and the PGPfone Alphabet". Proceedings of New Methods in Language Processing 2. Ankara, Turkey: Oxford University, Dept. of Experimental Psychology. arXiv:cmp-lg/9608021. Bibcode:1996cmp.lg....8021J.
  3. "Archived copy". web.mit.edu. Archived from the original on 26 March 2010. Retrieved 12 January 2022.{{cite web}}: CS1 maint: archived copy as title (link)
  4. "EFF's New Wordlists for Random Passphrases". 19 July 2016.
  5. mnemonic encoding Archived 2008-03-02 at the Wayback Machine and updated code
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.