You can use a passphrase consisting of four short, common words to keep your encryption key secure from attackers willing to spend less than US$1B to crack them. Just choose the passphrase with strong randomness, salt it, then spend a minute stretching the passphrase with scrypt. Memorizing such a passphrase with an optimal practice schedule takes several minutes, but only once in your life.
For this to work, you absolutely cannot make up the passphrase yourself with your mind. You have to use a truly random physical process such as rolling dice.
xkcd clearly showed that for online password attacks, a password like "correct horse battery staple" is perfectly adequate — that is, a password consisting of a small number of randomly chosen common words, with spaces between them, and no unusual orthography — while more common methods of choosing passwords are less secure; and furthermore that these passwords are easier to remember. But a footnote on the comic explained that this may not be adequate for resisting offline attacks.
(To those who wonder whether they should be taking security advice from a comic strip: ① the argument and calculations in the strip are correct, and ② you clearly don’t read xkcd. Also, in that case, you probably need to be told not to make up the passphrase with your mind; use Diceware or something similarly strong. Also you probably need someone else to write the software to implement this for you.)
In a chat with a friend of mine yesterday, I realized, much to my surprise, that this kind of password is also adequate against offline attacks, like those that someone can try against encrypted text they captured or against private keys, given certain conditions.
The approach is this. You take a randomly chosen passphrase, run it through a password-based key derivation function on a computer you trust for a reasonable amount of time, and use the resulting output as the encryption key.
("Brain wallet" is a broken implementation of this idea as it applies to Bitcoin. Most brainwallet-stored Bitcoins have been stolen.)
Let’s suppose we want the key to be secure against a billion dollars’ worth of attacker resources. A million is probably okay for most people in most situations, but a billion gives us some margin of safety. I calculated some computing costs in 2010; in particular, running a regular personal computer cost about US$0.005 per minute, which I’m going to figure is probably still about right.
The most advanced current password-based key derivation functions, like Colin Percival’s 2009 scrypt, minimize the cost advantage of special-purpose attack hardware relative to a regular personal computer; let’s figure that they keep it down to 8×, that is, that you can duplicate a minute’s worth of scrypt computation for ⅛ of US$0.005 if you’re using special-purpose hardware. (I think that by using a custom packet-switched memory fabric like the Tera MTA, you can probably beat that advantage by an order or two of magnitude, but probably only the NSA has done this so far.)
So let’s suppose that you, the legitimate user, are willing to wait for one minute, with one computer, to hash your password. That is, you’re spending ½¢, but you want your attacker to have to spend US$1B. This means you need to choose one of about 400 billion passwords, i.e. you need 39 bits of entropy. Plus three bits for the custom hardware advantage, for 42 bits.
"Correct horse battery staple" passwords can easily have 44 or 48 bits of entropy, using only four words.
In effect, key stretching is adding 30–50 bits of difficulty to breaking your key.
For a password like this that you never write down, even if it’s as memorable as "correct horse battery staple", you need to establish a practice schedule so that you don’t forget it, and it would be very helpful to have spaced practice software for this. Existing spaced practice software for memorization (things like AnyMemo, Anki, or Mnemosyne) is not suitable unless you’re already using it. It’s designed for memorizing a large set of facts, not a single one, so it only quizzes you when you ask it to run.
By contrast, in this case, you need to space your practice of just one password. I don’t know of any software for this. When I did this with a seven-word passphrase, I set an alarm on my phone repeatedly for the repetitions in the first day, and thereafter repeated the exercise each day for a long period of time by just using the password each day:
The intervals here are a bit more conservative than the usual 1, 5, 25, 125, 625, 3125 intervals for practice memorization, for two reasons:
The passphrase, although I impose linguistic associations onto it, doesn’t really have an underlying structure that simplifies it; so it’s inherently a hard thing to memorize.
If at some point I forget the passphrase, I don’t have the opportunity to recover it from some reminder medium, as is usually the case for things I’m trying to memorize. I can’t just turn over a flash card. If I forget it once, and it’s not still in my terminal scrollback, it’s gone.
On the fourth try, I misremembered the passphrase at first, suggesting that the schedule may not be conservative enough. The exponential factor in that case was about 3½, so you probably want something more like a factor of 2½ to be safe: after repeating the password for 2 minutes, wait 3 minutes, 7 minutes, 20 minutes, an hour, 2 hours, 5 hours, 12 hours, a day, 2 days, 5 days.
(This probably means you want to start this process in the morning, not at night.)
If you’re going to wait for an entire minute to hash your password, it’s kind of a bummer if it turns out you mistyped it. This is avoidable at the cost of slightly longer passwords. If the password is generated in a way that ensures that, say, the checksum of its 4-bit nibbles will be 0, then you have decreased the strength of the password by 4 bits, while ensuring that 94% of the time that you type the wrong password, the system can detect it immediately.
If the key-stretching program also knows the wordlist from which your words were originally chosen, it can probably also catch most typographical errors.
This is actually crucial for memorization; because of hyperbolic discounting, when you’re practicing your password, you need immediate feedback if you get it wrong. (Hyperbolic discounting is somewhat questionable when applied to people making choices consciously, but firmly established in operant conditioning, which is what we’re dealing with here.)
Alternatively, you could simply use a longer password and less key stretching, so that the key stretching process ends in around a second.
A billion dollars of computing effort today is half a billion dollars in a year and a half, if Moore’s Law continues. In 15 years (in 2029), it will diminish to only a million dollars. It's uncertain as to whether this trend will continue. It might even speed up: solar photovoltaic energy will probably overtake fossil-fuel energy as a fraction of our marketed energy in the early 2020s, and subsequently energy will become cheaper even faster than computing hardware.
Each extra bit of password strength gives you about a year and a half of Moore's Law lead time.
In cases like public keys used to authenticate forward-secret key exchanges or authorize transactions, being secure against future attacks is irrelevant. In cases like the encryption used for your disk, it is not. You should probably assume that breaking your disk encryption will become practical at some point, but you can probably delay that day by using longer passwords.
Believe MC Frontalot: you can't hide secrets from the future.
Speaking of defending against future attacks, what about quantum computers?
Grover's algorithm on quantum computers, if and when those turn out to be feasible to build, halves your effective key length. If applied to your 48-bit pre-key-stretching password, this would reduce its strength by 24 bits, which would make it feasible to break. You could use a 96-bit pre-key-stretching password (eight words) to resist this attack.
I'm pretty ignorant about quantum computation, so I don't really know, but I don't think you can apply Grover's or any other known quantum algorithm to reduce the effective length of your stretched key — the log of the number of possible passwords plus the log of the number of operations used in stretching — by half. If you could, then if your key stretching involves a trillion operations (about 2⁴⁰) and you want to resist a 2⁸⁰ attack, you need an effective key length of 160 bits, of which 120 will have to come from the password: ten words.
An attacker can gain some advantage over the defender by attacking many passwords in parallel. With the approach described so far, if there are, for example, 256 law enforcement officers who receive an encrypted email, and the mafia successfully steals all of their computers, the mafia doesn't need to spend a billion dollars to decrypt one of the officers' disks. Instead, they can spend 1/256 of that to decrypt any of the officers' disks: they try each generated key against all 256 disks. This way they can get the email after only a few million dollars' worth of work.
(Better, if someone does the billion dollars' worth of work just once, they can make a rainbow table of all possible keys, although with such a slow key derivation function, the rainbow table chain lengths will be limited. For example, with a chain length of 256, you'll need 2⁴⁰ entries for 2⁴⁸ possible passwords, occupying a total of 6 tebibytes; but doing a single lookup in the table will take 2 hours.)
The standard approach to solving this problem is to salt the passwords: store a nonsecret random string that gets combined with the password (for example, concatenated with it) before you run the key derivation function. Many pieces of software will do this salting for you, but if not, you can do it yourself. For example, for a disk encryption password, you can engrave the salt into the case of your computer, next to the keyboard. For example, your 48-bit salt might be encoded as "sting vowed woken hold" while your password is "crowd lasts men woody"; you type "sting vowed woken hold crowd lasts men woody", having copied the first four words from the engraving.
Being interactively prompted with the salt would probably reduce the incidence of accidentally typing the wrong password, a phenomenon which compromises that password.
The scrypt paper argues that sequential memory-hard algorithms give defenders an extra advantage over attackers: by increasing the amount of time needed by a defender to hash their correct password by some factor N, you increase the cost to an attacker by N², because the attacker needs both N times more memory and to use it for N times as long.
XXX
Memory-hard functions like scrypt, while necessary to resist custom hardware, probably cannot execute in constant-time on off-the-shelf hardware, because they need to generate and access large tables. But because the total time for the computation is so long, and because it can't be automatically initiated by an attacker request and remote attackers can't normally observe either the beginning or the end of the process, timing attacks should in general be very difficult to carry out.
Using phrases of English words rather than arbitrary characters adds a great deal of redundancy to the password, which means that even very minor amounts of side-channel leakage (such as keystroke timings, audio of keystrokes, or RF emissions from the keyboard) should make it possible to completely reconstruct the password.
I have no idea about power analysis.
The S/KEY wordlist from RFC1760 is commonly used; it consists of 2048 words of up to four letters. It has a couple of flaws: it’s only 2048 words (11 bits per word), when 4096 is easily achievable; it includes many very uncommon words, such as "Egan", "Eben", and "fogy", impeding memorization; and it contains many words that are too similar, such as "good", "gold", "goad", "goal", "coal", "foal", and "goat". For example, the 48-bit number 155759005738413 is encoded using S/KEY as "aid shin mini ruse made", except in all capitals. My preferred wordlist, instead, encodes it as "hay fork catch diary", which I think is dramatically more memorable.
Here are ten more S/KEY encodings of 48 bits, but in lowercase:
air limb dash mask laws
ace cock rip fond bask
an shy lind juno folk
all doug jolt lang sob
aim tank bed neil juno
an fawn wean aqua if
ada ding sea hive kit
ada lies nip aids howl
ada cut love will hum
am iris gut din bold
Here are ten encodings of 48 bits with my wordlist:
ici shrug slow solid
must fever plug hotel
facts foam gall frail
snake erika star i
belle feat dip waste
rent herr freud tuna
annie spade downs doo
grief sense infer cab
cuba g maths pig
days dusty small yacht
I generate these with bitwords.py, which uses the system truly-random-number generator, which is almost as trustworthy as rolling dice if you’re on a Linux machine that isn’t backdoored.
I derived the following wordlist by taking the most common 4096 words of 5 letters or less from the British National Corpus. It’s imperfect, as you can see above; it still includes some nonwords, uncommon proper nouns, and words very similar to one another. In practice, though, as you can see from the above, the words it generates are pretty memorable. Many of them are sentences or noun phrases, or almost: "Rent Herr Freud tuna! Must fever plug hotel? Grief sense infer[s] cab. Cuba G: Maths pig! Day's dusty small yacht. Annie spade-downs doo."
It also has the problem, shared with the S/KEY list, that it contains many words that are too similar to one another: it contains not only "sold", but also "old", "told", "hold", "cold", "gold", "bold", "solid", "sole", and "solo". This means that a typo or misremembering of a password is often also a valid password.
Previously I used the most common 4096 words in English (again, according to the British National Corpus) but it turns out that they are only slightly more memorable than these words, and substantially shorter. These are drawn from the most common 15898 words, adding perhaps 15% to the difficulty of memorization (log 15898/log 4096); they average 4.25 letters, while the most common 4096 average 6.57 letters, adding 55% to the time needed to type them. This tradeoff seems reasonable.
the of and to a in it is was that i for on you he be with by at have
are this not but had his they from as she which or we an there her
were do been all their has would will what if one can so no who said
more about them some could him into its then up two time my out like
did only me your now other may just these new also any know first see
well very than how get most over back way our much think years go er
many being those yeah work got down three make us good such year still
must last take own even after too right here come both does made oh say
going erm might same under day yes man use world when want life while
again never put old need used home mr why each part house off went end
look came four give local great small place mean next case find group
quite long five party every women says later given took point men set
away often seen money fact night found since less done thing area taken
help hand best mm state water head where large yet young side days john
ca left week form face power until room tell able six high told half
times eyes doing court major war car keep once asked road open am saw
today full knew feel let ever name mind far door law voice above body
early big book known using words child main clear began show means upon
areas woman gave act round whole among real job staff black view line
city white felt kind south age start idea study sense level run read
sort third seems care try else free order thus pay past ten shall death
table love north mrs whose ago range play leave land gone ask word turn
trade few air move food team west hours god hands b sir rate cost lot
held data role cases class town bank value needs union call true price
seven paper uk eight type wife seem close heard live near sure east based
terms hard wo c stage club cos makes hope comes issue soon bed girl na
david rest tax weeks bring poor top shown music month game ways talk art
royal cut goes offer april field june news works short lost hair basis
below force lord bad stop feet meet hear king heart board fire story
nine light wrong human per along final deal boy total nice de press legal
books bit whom son march lead plan sea red hold late size space died st
nor gon peter low list lower worth term buy thank date cause okay share
model miss stay prime july sound fine dead wall test happy takes added
parts loss visit floor rates allow army sorry paul stood hour easy basic
dr tried costs wish ideas arms risk mark sat unit fish write hotel met
aware park paid style miles kept ones cup maybe s gives sales page event
shop hall rose looks bill oil claim lines james blood forms goods fell
film rules ah sent carry stand v led wrote plans york ready glass site
front wide lack cover jobs lay fall moved girls title eye lady trust n
speak p river lives mouth piece walk wales heavy task arm win green d
note baby rule post older fully radio peace rise hot types sun ran wants
sale break box sit watch civil ii tea fifty built m won spent extra none
firm knows blue trees shows sex learn cash wait add match agree aid drive
duty dog dark truth boys send born step sign media avoid apply key deep
smith plus huge mum brown chair e reach stone male plant gets horse bar
base award earth phone fear text cells edge race chief eat spend cars
begin mhm firms scale image cold t join speed wind names foot views
ball stock gas pain sell drawn worse train hit mary units save smile
meant skin build spoke warm drink banks wood dear rich pass dad sleep
fresh scene steps r band x draw crime items forty dry shot enjoy hill
sight users tv ec legs stuff fit lose daily trial vote queen tree rock
pound check inc rain equal mine fund sides henry farm fight ahead joint
wine usual rural fair twice path judge funds touch tend onto games ring
seat walls pick soft safe shape o paris aim cross ought homes pair track
grant due doubt sold user japan raise goal birds video notes lived clean
sites prove g empty card copy grand heat occur beat rooms cell quiet
neck urban grow h tiny die exist seek route least upper tour boat jack
arts leg serve ian hell bus focus worry enter faith facts shook lunch
heads alan irish fast thin crown broad star bear aye entry birth busy
corp broke vital gold italy coal alone ltd drew tom etc lips shops usa
owner tony sky grey wider slow leeds bag debt wear mass iii waste catch
talks acid hoped milk laws worst gain doors hence ibm net spot f guide
la teeth tests flat india un goals vast file brief drop suit kinds wild
link rare via phase kill fixed ship harry signs row jones metal brain
lie liked minor ta coast uses ooh grew tall youth quick lots iron hole
drugs noted sport desk noise limit lying brian inner funny chris odd bob
spain pool seats tape motor dogs co dress pages crowd anne lies china
steve sixty agent calls sum joe badly lane jim tone mike flow jesus
shock nose pull simon dream meal alive van begun yours bbc jane angry
code sheet unix fuel block aged tears kids grass roof store armed faces
fruit towns lucky reply sets drug glad sharp index l th taste ideal guy
soil shut cope song frank till argue ai lift lake ref fill teams roads y
stars cards w cat trip stick hello ice error rail loan theme pub refer
chest bird grown map keen item port count clubs cast marks loved lewis
j bread links eggs drove wages score aims tasks panel lee yards tells
roman diet chain shoes runs ha aside bound plate meat admit hopes fifth
weak tired pale treat adam gate sees luke uncle smell hurt self bath
apart welsh ages rapid beach laugh eh gun sweet sons push fault sarah
lords dance laid plane sad rough sugar golf bid coat scope enemy smoke
tim wave pure nigel bits rome snow drama ward films fail gap tory beer
frame mood camp du acts solid fly thick input shift throw feels sake
mile wet mill moral truly scott k bush tools iraq wage aids ken mad ben
mp duke ends hat sam skill faced nick hills bay fewer abuse proud threw
pilot yard core neil hang aunt crew bell prize asia sheep steel ruth
rent bills holy paint sand anger ears soul wore depth vary nurse blame
pop cry finds pack blow sorts tough jean ease guess arise pace turns fees
boots rugby puts awful luck spare cuts ear novel ok load songs ride poll
ratio boss clock chose plays keith delay fee split tank wing silly mixed
tower minds kong false iv cheap mail guard andy sick cake cycle rocks
cried hong joy cook roles wan host likes print dirty fun feed mode le
dozen newly rely pitch lucy loans helen ban hate taxes fears rang votes
teach knife coach harm dealt marry bet proof dave pink unity mere dust
pride deaf peak waves draft gift named buyer ships rid kent shirt fans
wheel blind roll wake aha ill u owned anna roger holes knees salt mps
cool keeps sixth terry flesh bond hers trend dna egg ended tail saved
layer gross boxes raw colin outer nhs bomb topic tends laura holds angle
san bone kiss jimmy adopt squad mummy disk tie meals sue alice fat helps
guest bare vat roots lists poem moves wings texts flew hide opera kevin
leads upset cream hunt lloyd exact logic essex acute jury valid zero lock
moon bands apple deny bones bars re fleet files mix males tip owen poet
dates adds billy egypt earl fate dutch tool steam hero keys wise stuck
wash gene risks storm des sole habit era mayor sing spell root mess gates
joke pipe greek dare woods dawn grace fred clare kelly plain bowl folk
pupil louis maria pen album curve pairs diana beds adult jump ruled kick
tied zone foods latin hugh genes trace silk cm susan tight loose naked
knee daddy canal cloud posts gaze lease bulk navy crash rush pot diary
climb tin ad urged guns wire iran magic slip actor ray asks boats panic
emily bible worn phil sheer bonds robin piano lands burst alarm ocean
baker ann marx cloth wives aimed solve sadly pope eric mud ross moore
audit ford shed eliot shame lad alex kings barry gear raf taxi pat mouse
flats shell villa rank inch derek earn calm wars yield mills smart gay
evans minus fails gary dying plot eg tale rival dull asian jews label
farms marie grade scots abbey acted grain cap alter pity penny cheek
allen movie nasty fancy nt belt reign pile crazy roy wool grip shots
fool rear joan chip falls brick bags bike fox asset bye shore jenny risen
ira hey chips ate ya tide boost sizes rows edges tries voted neat forth
pan ours halt knock don les breed arab ussr debts rape giant opens lover
damn shit da ye hated craft bench bruce wound brush fence kid ms liz tap
damp hung brave rice swing eaten plc tube sink mount fed glory fig liver
pond chaos hiv clerk stake dec disc hurry korea loud chart ed guilt poems
karen pause sums q menu dish clay essay acres chin cats arose ranks strip
shoot debut oral widow rope evil prey coup super crack slept ph faint chap
noble harsh lamb bull pit manor iraqi fired fibre odds winds balls roses
seeks beef kit lads kate vague dose ma mate grasp naval deals bore echo
patch steep pray di cable tune dick rob swiss blank julia imply ie virus
burn trap lit races gifts sally buses pc mild quid rigid boot bases yer
drank trick lily tray myth gang shake forum nato gains seed eager grave
fan walks emma davis mines deck dean cab waist relax jan sword hint prior
awake crop eve dried raid suite meets fraud woke boom verse bias km julie
inn slide loads honey cruel nest fatal max hire flag gods duck lip ham
ugly grief isle sandy rally loyal elder ali al coins fix paths soup pole
oven betty bent lorry bonus wells hook seeds sail organ cure quote brand
flora blew vi beans sin pence brass solar flood yep waved slope shade
slid oak pubs nerve pm theft ace bow joyce mick straw bold jet devon
cliff backs shout br shelf grows skirt los leaf freud loch juice dated
bloke jeans devil tales ici craig urge el slim owed angel pete kim sara
owe crude cow loves lap barn drunk poles lisa lean soap maps seal santa
swim charm ozone elite react fuck alert pint ghost blown modes bowel
torn bend ridge sits saudi bunch tapes saint safer jail lend fame geoff
yo robyn lakes rod hull ralph coin fires corps suits spots corn swept
serum crops bite ties swift stops log stamp grin bile wins cups toxic
tommy sang truck tons shy fond dot lodge fetch jazz basin burns eddie
dual bacon tent pie gray fry rage cd width heath ft pays tel twins ted
rats z tenth stir guys grid punch lamp drag array plea fa drift lobby
eec li chat rode mask sigh fury derby parks mist pig trail eagle bp sank
rolls rings sauce pin nails lemon ports medal pour cared borne venue ash
ferry intel alike salad shoe palm tiles tanks ml clue sweat hired lump
photo flown elbow amid tokyo blues pains fluid lid bombs toys weird
pools wee thumb lawn stare cabin grim wiped tense hp dies bears warn
polls stem wines matt blake pump fled oz gaps cited jason chase tutor
heels clash von tidy bt wrist reid gulf fort bored flour bass crews
ho skull draws hardy clive arrow allan twist dock tear yacht hut beam
vivid exit mice cave bride lion swung hi noisy rocky graph sofa mercy
bang clark bells bc linda lea kenya flash acids texas realm pose probe
axis sack dig bobby lanes aloud sunny camps holly lined jokes ulcer
usage maths owl blade reads toast folly burnt rude denis slice donna
wheat cakes ellis blast norm jaw sri sean merit heir dan adams scent
duly janet gould shaw fist milan gazed ninth knit adapt sa exile cows
owns bat lace faded drum linen laser gp drops marsh dos cape sweep par
codes dirt hits rat pigs gdp dug poets non irony dairy annie hedge rebel
moor cease stole rider lung glow chalk tips ryan limbs beard deer queue
flame cage fog dense carol paula doyle lions gall fined agony maker fits
handy toes pots polly lets hood ron arena mains drain bitch pipes lone
pa pulse bury flies agnes frost choir steal maid ivory pr leo ego fever
metre tops itv verb vice shaft spine ruler slave bail zones canon seas
atoms altar giles bleak grab towel rises fur decay tones meg lungs leap
horn pact fare stiff drill torch locks rex nuts hay fuss dc ankle belly
jo clues reed wit halls socks hats quest carl loop papal loses flows
cart tours telly quit jacob glen danny pet swan isles gloom ex fold
jeff stays spray pine ros exam wary trips pp lazy greg cargo paddy hm
dame ample vicar hips gut quota fairy petty mould arch spin posed boris
nina kin plug dim souls prone molly cult alien urine coats swear norms
yarn sore madam levy wayne tyres crohn peaks del beast veins gases ac
onset oils ally brow scrap creed monks eased beg mason jam cries colon
wh batch maxim ux prose herbs tubes peru mini gauge float naive jill arc
alpha wendy whip solo feast riot disco thou ruin bees blend peat rosie
ord dusty dared jamie risc vii dumb baron shiny discs valve iris surge
lanka boil bin siege nazi cuba stool ellen spr cork stall obey tribe nil
heap vic bolt vein tore pits sells fork fax wipe wards noon mg audio
piper lb heel peers ski serbs ram libel oddly penal libya rifle poole
gill stark dolly cheer mug civic twin foul hazel spoon thigh thief slot
cafe weary tens prix soils hip baths flock wears toll tyne sunk trunk
lydia disks czech nod gown mates vocal pro grove para hid depot lang ba
vale khan idle icl sh spurs filed comic utter sexes lp spy cord ruins
roofs cloak leas wolf tate docks min daft cough gmt bowed axe riots dana
syria knot joins amp peer trio raids doll um ps lent alec risky lens
walsh int icy buys midst jolly bind webb sparc herd coun ch sour rug
polar shine nancy lacks cairo pony deed rents dale snake orbit onion
trent cor fines wigan mock hurd bryan alas snap rosa kite tiger leith
gps exams zoo mips mac cara thy thee sexy gnp screw purse owes ink eden
dash viii sends rays envy crept aston nut dump ducks flung crust stack
dee hans guil downs drums basil rub cecil tooth skies opt alton skins
leigh jake fists tha node bald sung ripe odour nylon attic muddy cosy
guild vet span ni anc peas hmm pad freed apt nets nail sworn lou doses
ribs kohl sober rails malta chef bland mars hart deeds roar peggy pearl
lime dusk radar teddy cater verge pi stove rev rack hobby spoil morse
dome dixon alley eva lenin erect nicky imf rated olive dip blaze witch
rna gavin token idiot repay jar genre toe stems horns blunt salon nanny
moses fiona si lyons celia calf piles tins donor ditch beta amino beth
watt trout sins lied flush web overt delhi cia algae tt seize noun ssr
monk mob labs ale weigh pork pills chile saves ropes pike crane hosts
cs crest bulbs se greet glue hairs cox moist ads hatch bless acre scan
jaws frail cares scum piers ivan wires marco perth duchy herr flu chuck
alain wax rory costa ants myths motif dive pulls mungo gig daisy toy
larry kenny islam irene chord peel mandy knots sha moors foam overs
ellie bolts lynn sands melt globe chill haven fuels plo lambs bowls
bids slate pier worms veto slump lab isaac curls writ wed dole tomb jug
huh lifts swore porch peg pasta kemp arse ions crap cole wrap oct hague
lasts dam rim picks mare elect deter bust beck abbot gel pal tract raced
oath cohen brook mins limb finer nuns medau ftse curb buzz molla jerry
exert bmw kgb glare bean query merry merge void stoke mon logo mo mole
wreck loft cans anal tag rover ivy hints yen tudor rugs haul blows sly
nov moss goat tyre lucas woven tweed penis karl icing bee rick mid mat
lever brake amy spark gerry focal rio faye bark arabs turf otto jelly
hugo theda steer mann await sting tails reef brisk noel kills erika caps
atom rung quinn trim spa frown frog bred awe qc pints mama litre lamps
curry tug ee plump cites opted silas newer gin bloom wagon swap fen cdna
pam fiver dots dire beads wills undue stray packs hare cock click whale
ashes swell palms kg chess ronni fiery doug tsar punk couch ponds pets
rot junk flux woken tees tee apron flint wa shah cl bert weir weeds raped
pinch nora marc tick leak kylie cathy aided tina moira knelt gangs carer
bonn heal den seals po pest meter piled baked amiss turks ton scarf watts
puppy beams weber renal der delta curse creep wow worm renew prop plots
fake ricky niece vs verbs urgh shrug hurts warns hears cocoa avon seb
icon mam leapt ti sudan shaky dover taxed luce bates smash pears locke
froze dread aisle ter benny alps satin pill len bait vowed jenna cf bach
pens ore juan beers slab poses mast edit diane unite scare flee edith
boxer batty nan wwf stern nec guts cane assay chop aa tbsp slam aea
stout singh pants maze kay con gcse venus val nme mint folds polo lava
pies menus gina cot bloc ion frogs fills dwarf bulb vines rig pcs jets
foil doo curly tidal spur howe luton cruz crush rotor hen papa oi nun
nazis hq wry windy en crisp cigar ant liam ethos ahmed rusty kirk cuban
ag maud hindu fade caves kicks blah bella piss bikes noses hens cubic
benn wade reg clan robe percy loo goats gale coral burke sails rag niche
nests stain reins lays prof veil slap olds det beech badge tummy ryder
reds fr fares dhss skip flags diy tack sas pins wea swam felix ci thorn
spit pizza zinc troop patio lager jaq witty sod grips eyed strap kpmg hop
gala dunn boast blond quiz lest id brink booth akin vase nave jew typed
fours ncr mound jeep goose fumes cling ruc posh carlo beats tuc tram thai
mums mar hairy gypsy necks hilda fife est selby oscar insp gower drily
brows tread slabs buck nizan nixon epic aura amend tesco stale remit mph
moods hyde berry spill robot byrne bunny salts gis eats spun sid groom
cue lowe huy toss tents sic bake weed vowel stab sql owls mario foxes
butt xi wha sued fe clara wits tracy lush grill edwin diets unto slots
rift geese boro bats widen visa spd gibbs unfit logs forge et cache tan
saga nell folks es carey tenor oxide nodes bout clip flank dizzy truce
tier ss lo gran faldo cc sub rides notts judy dales belts scar rites
cyril coke trays elves curl tunes steak rue roast suck gasp razor lust
wlr rum jon dane bump birch wilko rouge micro cod kirov dunes svqs shh
tessa loaf gosh wedge stony sperm ramp mas foyer bum wight malt dye dial
cone chaps bucks tonic tides sec gum cop tasty spat nobel locus gloss
glenn cam tort tae masks hates hari flap feat womb taut miami rib boyd
awoke wi todd nepal greed gen cnaa stair pumps pious lili heirs haste
scrub candy tile teens jed fonts clung bud abu vans rita opec miner
edgar cured crawl zen vine rip coil trams gym bows wiser vain tow quay
burma glove fuse diego crag ache tuck em becky rees lure fried carla
plead jewel groin duo gorge desks carp soho riven pleas moody messy liar
katie josh ghana ethel pcr cheat tuna tramp dice angus os fetal claws
seam hooks avail peach ayr axes taps tame leant chant vms herds gaunt
gamma feeds comb tempo proxy sip belle rye monte loser dolls cfcs bulls
tara crewe swans sdlp pros haunt elton stan squat ne las lais firth camel
wryly tying memo jose hms hefty heady hasty hal drown col wrath rods haze
mend crypt arid wacc spies fools fauna cose boar viola topaz perry mod
cues bulky aroma ounce lick ledge gleam cops canoe tsp rests inns havoc
dti soda shaun pests paste bra zeal smack orcs dora oxfam nile lawns
kb slips ro newco motto euro bogus au vault jay spate nicer kits kev
hangs genus nomes maize lotus forte wyatt mused lynch herb sleek scrum
floyd elvis edged toby soak paved mesh hum doris aback subs smelt lain
waits moles lapse doe doc brew amen mao lumps flick decor cube ono il
dived bs scalp rains kerry ruby ldp dwell cider bony tonne rufus liner
hymns hug guise gigs clown rash seams gm zip yu sings earls blur undo
sown scars infer ibid frome edie dcs broom wig traps shove scorn rosy
regal bream timed fins deane bully payne hawk frau flute fbi dodgy defy
barge yemen suez slit sacks pores bliss vera spike rave leon jade hush
hind franz aug weep sgt rags mel jules gwen gilt dove munro envoy cegb
brace vodka stud hon hayes fiji eerie cds ana xv vol ups rica pagan oed
lear flask woo lofty icons cooke clwyd taxis sae plato incur huts shave
ow inset ills gemma fabia cute bnfl bays wasps resin loops kyle deity
csce woody noah moan figs dent sane misty lt friar evoke trait timid
tech alloy yeast vent tacit sd gatt flair creek tempt rsc franc apex zoe
vinyl robes rap ploy hymn grit fin fairs cp wept inert buds trot spade
pals darts bug ass tilt nash milky cite chew casts oats nay muck modem
mc laden bog gulls emi dell chunk arson tub suede satan rust jars hype
groan fri weave tally micky mi jumps dimly bluff urges slum rogue cis
pegs frs cr skye seoul plum pans kurds wares taped putt pops lima holt
gully fc abide rite oval dough coded tncs stew smear sited peck macho
grind fo dss clone sway paces lass hem rune relay oaks dummy doom dept
shire sheds scant phd pe oily knob blitz smug pouch farce demon danes
cooks voter tunic spear scot josie flaws famed cents pedal lids lag hath
gaol foe finch dup crow blair sniff scoop muted joey clyde aide vicky
sybil shady poked peril eds beak rein numb mead ix cprw vile spice sized
levi idly fella fats dj cid stead sauna lj carr bunk blot amber null
nude niall heed harp fungi ethic dues crook willy sped reap monde crab
cages rake laing havel gravy gaily fatty ebb boyle whigs queer gooch eqn
brett tiled scout rab pads limp dart bruno metro inter font daly barns
swamp nouns maine hose feb agm sage rump ra plank lame joys flare chick
bsl bingo tuned spelt pnp mince lipid filth dine baggy troy tombs knox
cords bgs parry joked gail dun blush te snack shrub shone oasis nasal mop
evils viral uh synod sow riley rhyme moths ilp grate finn claw airy nam
klerk duvet casey atlas rspb nip luis gears edna bun aunty whore twigs
snp slack rinse platt mrna ge dogma chi bede vest tamil sneak qb perch
lunar ju hides henri coals clamp stump stein pram oecd klaus ds snail
seth klein jock jehan hub gogh glc gland