Can an attacker exploit the nonuniform distribution of letters in a diceware password to improve a brute force search? I use some diceware pass phrases in some places but I have one question that I can't find the answer to.

Let's say I roll the dice and get $N$ words with a total of $M$ letters and that I don't put spaces in between the words.

An attacker wishing to brute force my secret could have to try $7776^N$ times to break it as a diceware pass phrase OR $26^M$ to break it as a "normal" password (assuming I get only words with letters).

But the attacker trying to break it as a normal password could assume that it is made up of English words and then they'd know that some letters and combinations of letters are more common.

So my $M$ letters will not have the entropy of letters selected at random but some lower entropy.

My question is, what $M$ do I need to make up the same entropy as the $N$ words?
But the attacker trying to break it as a normal password could assume that it is made up of English words and then they'd know that some letters and combinations of letters are more common.


They could try this, but they would be stupid to try this, because there are many fewer $N$-word diceware passwords than $M$-letter strings of English letters of the same length as an $N$-word diceware password!

Suppose you use a ten-word diceware password.  There are $7776^{10} \approx 8 \times 10^{38} \approx 2^{129.2}$ such passwords.  This is already a larger haystack than any adversary can find a single needle in.  (If passwords are hashed without salt, an extremely powerful adversary may be able to find one of many needles in a haystack that big, but you could pick $N = 20$ instead, and the service oughta salt their password hashes.)

Any distribution on sequences of $M$ independent English letters that covers more possibilities than these $7776^{10}$ diceware passwords is an even larger haystack to search for a needle in.

A smart adversary, who knows all the details of your method and just doesn't know the password you chose by that method, won't give themselves a larger haystack to search in.  A stupid adversary who does give themselves a larger haystack to search in will just waste more time searching!

For example, the distribution on $M$ independent English letters following the usual letter frequencies in English would give relatively high probability to sequences like aoqothropaaeeaetphtticawglesttgeectoyheldshnfznecr which has a lot of e's and t's and a's but not many z's, x's, q's, etc.  This is not a possible diceware password, however, even though it has the same length as a ten-word diceware password with five letters per word.  And it would give lower probability to woozydizzybuzzyfuzzyjazzymezzoexxonpizzapyrexvixen, which (with an appropriate word list) is a possible diceware password.

Let's work through a simplified example.  We'll use a dictionary of five words: cat, car, act, art, and rat.  We'll pick a single word uniformly at random from the dictionary, so that each word has equal probability 1/5, with just over two bits of entropy.

The corpus in this dictionary has letter frequencies a 5/15, c 3/15, r 3/15, t 4/15, under which distribution each letter position has under two bits of entropy.  There are $4^3 = 64$ possible three-letter words from this alphabet, of which the vast majority, 59, aren't in our dictionary.


An adversary trying to guess our password from the dictionary has a $1/5 = 20\%$ chance, of getting it right in a single trial.

This is the smartest, most efficient adversary.
An adversary trying to guess our password from the letter frequencies independently has a $\frac{1}{5}\cdot\frac{19}{225} = 19/1125 \approx 1.7\%$ chance of getting it right in a single trial.

Why?  The distribution on three-letter passwords is the product of the letter probabilities in this model.  If the adversary guesses a word in our dictionary this way, there's a 1/5 chance that it's the right password, but there's only a $19/225 \approx 8.5\%$ chance that the word the adversary guessed with these letter probabilities is in our dictionary.  With probability $206/225 \approx 91.5\%$, the adversary will be guessing passwords that you would never have chosen: they're wasting most of their time barking up the wrong trees in a much larger haystack.

This is the adversary who takes advantage of the per-letter entropy as you described.  Even if they sort by probability rather than choosing randomly, they'll first try aaa, then aac, then aat, aca, etc., wasting time on impossible passwords.  Even if every word in the dictionary happened to come first in this ordering, this adversary has no better chance than adversary (1).
An adversary trying to guess our password from the letters, ignoring the frequencies, has a $1/64 \approx 1.5\%$ chance of getting it right in a single trial.

Why?  Under this distribution, every letter has equal probability 1/4 independently, so every three-letter word has equal probability $(1/4)^3 = 1/64$, including the one we chose.  With probability $59/64 \approx 92\%$, the adversary will be guessing passwords that you would never have chosen.  They're also rummaging through a much larger haystack, but they're doing it even less efficiently than adversary (2).

This adversary just tries all combinations without regard to letter frequency.  As you can see, this adversary is slightly worse at the job than adversary (2), so knowledge of the letter frequencies helps a little bit, but they're both much worse at the job than adversary (1).


Every word you add, if drawn independently, multiplies these probabilities: pick a second word independently from the same dictionary, and adversary (1) now has $(1/25)^2 = 1/25 = 4\%$ chance of success, adversary (2) now has $(19/1125)^2 = 361/1265625 \approx .029\%$  chance of success, and adversary (3) now has $(1/64)^2 = 1/4096 \approx .024\%$ chance of success.  If you make the dictionary large enough and the sequence of words long enough that you defeat the smart adversary (1), then you also defeat the stupid adversaries (2) and (3).


  My question is, what $M$ do I need to make up the same entropy as the $N$ words?


Don't worry about $M$.  Pick $N = 10$ for diceware and you're all set.