More Language Issues

But this time it's with English. I've been working on several conference papers, (hence the scarcity of posts here), and one problem I keep running into time after time is the lack of standard terminology when it comes to password cracking. Here are some examples of that:

1) What exactly is a passphrase?

• Would 'manbearpig' count as a passphrase?
  
• How about 'superdude'?
  
• What about passwords created by the first letters of a phrase. For example, "To be or not to be" = '2bo!2b'
  
• Should the above example be called a password or a passphrase?
  
• Can the term password and passphrase be used interchangeably? 
  

2) What exactly is covered by the term 'Brute Force Attack'?

• If you try all combinations where the first four characters are lowercase letters, and the last two characters are numbers, is it a brute force attack?
  
• Side note, I'm a fan of the term 'targeted brute force attack' for the above option. I've seen 'indexed attack' and 'incremental attack' used as well.
• What if you use Markov models in your attack. Is this still a brute force attack? A Markov model uses the conditional probability of letters showing up in combination with each other to produce strings that resemble words. An example would be if you see the letter 'q' then the next letter will almost always be a 'u'. With these attacks you usually only try the highly probable strings so you don't exhaust the entire keyspace like you normally would expect with a brute force attack.
• What about attacking passphrases? There are two main ways you can attack passphrases. The first is to use a dictionary of known sentences, (such as 'to be or not to be') which resembles a normal dictionary attack. The second is to generate your own sentences based on individual words, such as select five words and combine them. The second method looks a lot like a standard brute force attack, but instead of selecting from 26 letters you are selecting from several thousand words.  In fact even the approaches to make it "smarter" are the same, such as choosing certain words to start the sentence, "A To, The, ...", and using known sentence structures, "if a word is a verb, then it will probably be followed by a noun, etc".  You can even apply a Markov approach to model sentence structures if you want. That being said, these attacks do use an input dictionary so should we classify them as dictionary or brute force attacks?
• My own personal view is that brute force attacks encompass any password guessing attack that does not use an input dictionary. That being said, the term brute-force can be misleading since there are a lot of things an attacker can do to create very sophisticated attacks even without the use of a dictionary. Also, some dictionary based attacks can look a lot like brute force, aka adding four digits to the end of a dictionary word.

3) I referenced this in an earlier post, but how should we talk about the order in which you execute word mangling rules in a dictionary attack

• I'm tempted to go with 'word order' when you apply every mangling rule to each word before moving onto the next dictionary word. Cain and Able uses this method
  
• Similarly 'Rule Order' would be when you apply the first rule to all of the dictionary words before moving on to the next rule. John the Ripper uses this method
  
• Finally 'Position Order' treats dictionary words just as an insertion rule, (aka insert a dictionary), and then expands the rules from either left to right or right to left. For example if the rule was "insert one digit", "insert dictionary word", "insert special character", if it expanded from right to left it will cycle through all the special characters first, then cycle through all the dictionary words, and then cycle through all the numbers.  So it would create guesses the following way

1cat!

1cat@

1cat#

1hat!

1hat@

1hat#

2cat!

2cat@

...

• The best known password cracker that uses position method is Access Data's PRTK.
  

Now all of this may seem trivial, but if you don't use common definitions it's really hard to make any progress in sharing knowledge, debating issues, or solving problems. It's almost too bad we don't have an equivalent of the Webster dictionary for security professionals.