Summary

  • The December 1994 RFC 1751 proposed a human-readable representation of a 128-bit cryptographic key. It reused S/Key's fixed dictionary of 2,048 short English words and applied its six-word conversion separately to each 64-bit half.
  • The word list was fixed across implementations for interoperability. The RFC warned that a person inventing an easy sentence would make the underlying key easier to guess; the conversion was meant to render an obscure key readable, not to award strength to a phrase someone liked.

A key the machine liked and the operator hated

A network device can compare bits all day. The person installing its secret has to read, copy and type them, usually at the least poetic moment of the shift. RFC 1751 began with that mundane collision. SNMPv2 security work had described keyed message digests, including a 128-bit key context in the security-protocol specification. McDonald's memo took the human interface as its subject. How could an operator move such a key between paper, terminal and memory without mistaking one clump of hexadecimal for another?

The precedent was S/Key's one-time-password word scheme. A 64-bit value became six words selected from a dictionary of 2,048 English entries, each one to four characters long. Six choices from that list have room for 66 bits, leaving space for parity alongside the 64-bit value. The words were compact handles for a number. Their usefulness came from being easier to see, say and enter than the raw bits, while software could map them back.

McDonald did not redesign the 64-bit converter. He ran it twice. key2eng took each half of a 128-bit key through the existing six-word routine; eng2key performed the reverse trip. The result was twelve words in two groups of six. The memo's sample hex key became a string beginning “RASH BUSH MILK LOOK BAD BRIM” and continuing for another six words. The output sounds like a particularly unhelpful telegram. That is part of its virtue: it is a deterministic representation of the starting key, rather than a slogan chosen because it sticks.

The shared dictionary was the less charming but more consequential choice. McDonald explicitly rejected separate dictionaries for separate natural languages. Different word lists would turn the same bits into different phrases and break exchange between implementations. The existing list used characters from the invariant part of ISO-646, and applications already used it. The standardization move was therefore small and strict: one fixed vocabulary and two existing conversions, applied in sequence.

A user reading the list in another language still encountered English words; the interoperable byte-to-word mapping took priority over local vocabulary.

That fixed vocabulary did not create the secret. The key's obscurity had to be present before the words appeared. RFC 1751's security section identified the temptation: people might write a tidy string of English words themselves, perhaps even a sentence, and type it as a key. Such a choice gives an attacker a smaller, more human-shaped search space. The memo described the possibility of a sentence-style dictionary attack. It is the difference between printing a randomly selected number in a friendly alphabet and asking a person to invent a pleasing sentence. The display layer cannot repair weak key selection.

The RFC printed the reference conversion code and the 2,048-word list so implementations could perform the same mapping in both directions. That detail mattered as much as the anecdote about remembering words. A human-friendly encoding is useful only when one machine's twelve words return to the same 128 bits on another. The code, the fixed list and the two-half procedure made the representation testable. An operator could copy the tiles; the receiving program could reconstruct the key and compare the result.

The result was a peculiarly 1994 compromise. The Internet was trying to make authentication keys long enough for machines and short enough for people to handle. Twelve tiny English words were easier on the eyes than a dense key dump. They were also a reminder that usability has two directions: a good encoding helps a person carry a strong key; an easy phrase can invite the person to substitute a weak one. McDonald's convention kept those two acts separate, at the narrow point where human fingers met a cryptographic system.