PGP word list

What it does

The PGP word list turns each byte into an English word. Reading twenty words down a phone line is far more reliable than reading forty hex digits, because the words were chosen by a genetic algorithm to be as phonetically distant from each other as possible.

The pipeline above does two things: it decodes the hex fingerprint into raw bytes, then converts those bytes into words. Paste a different fingerprint over the example and the words follow.

The clever part

There are two lists of 256 words. Bytes at even positions use the two-syllable list, bytes at odd positions the three-syllable list.

That alternation is an error-detecting code you can hear. If a word is dropped, duplicated or swapped with its neighbor, the syllable rhythm breaks and every word after the mistake lands in the wrong list. Decoding here reports exactly that: feed it a word that is valid but sitting in the wrong slot and it tells you a word was probably lost before it, rather than silently returning wrong bytes.

What it is for

Confirming over a voice channel that the key you hold is the key the other person holds. This is the step that defeats a man-in-the-middle attack, and it only works if you both actually do it.

It also works for reading any short byte string aloud, though fingerprints are what it was built for.

Where it came from

Designed in 1995 by Patrick Juola and Philip Zimmermann for PGPfone, refined later with contributions from Jon Callas, and used since in PGP, Zfone and ZRTP. The example loaded above is the one from Zimmermann’s own published table.

Related

Hexadecimal is the first half of this pipeline on its own. The NATO spelling alphabet solves the same problem for individual letters rather than bytes.