Brute force analysis of PsychoPass-generated Passwords

Recently, Cipresso et al proposed a novel method for generating textual passwords. The PsychoPass password can be created, memorized and recalled by thinking of an action sequence instead of a string of characters. Objective: The objective of this paper is to analyze how and when the PsychoPass passwords are resilient to brute force attacks and how they compare to randomly generated ones. Methods: The PsychoPass method was studied analytically. The number of possible different passwords that can be created using PsychoPass method was calculated for different possible settings. Results: The PsychoPass generates passwords that are resilient to brute force attacks with password lengths comparable to those generated randomly. A PsychoPass-generated password with 18 characters is as strong as a completely randomly generated password of length 11 characters with mixed upper and lowercase letters, numbers and symbols, but can easily be remembered. Conclusion: The PsychoPass method is an alternative to the existing passwords and is resilient to brute force attack. There is no known dictionary to enable the dictionary attack. The PsychoPass passwords look like random ones, eg. ≫Ey|dX%7Tu]6hJ≪, but a user can easily remember it based on the action sequence instead of remembering its characters.