RFC 1938
A One-Time Password System
RFC 1938: A One-Time Password System 🔐
okay bestie, this is RFC 1938, and it's giving Standards Track energy 💅
- Authors: N. Haller (Bellcore) and C. Metz (Kaman Sciences Corporation) ✨
- Category: Standards Track 🎀
- Date: May 1996 📅
- Obsoletes / Updates: the title block doesn't list anything it obsoletes or updates 🧚
Status of this Memo 🌸
okay so this doc specifies an Internet standards track protocol for the Internet community, and it literally requests discussion and suggestions for improvements 🙈 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 💖
1.0 ABSTRACT ✨
this document describes a one-time password authentication system (OTP) 🔐 It handles authentication for system access (login) and other apps that need auth, and it's built to be secure against passive attacks that rely on replaying captured reusable passwords. The vibe is super secure! OTP evolved from the S/KEY (S/KEY is a trademark of Bellcore) One-Time Password System that Bellcore released, and it's described in references [3] and [5] 📚
2.0 OVERVIEW 🦋
one form of attack on networked computing systems is eavesdropping on network connections to grab authentication info, like login IDs and passwords of legit users 👀 Once that info is captured, it can be used later to get into the system. One-time password systems are designed to counter this type of attack, which is called a "replay attack" [4] 💅
the authentication system described here uses a secret pass-phrase to generate a sequence of one-time (single use) passwords ✨ With this system, the user's secret pass-phrase never needs to cross the network at any time, like during authentication or during pass-phrase changes. So it's not vulnerable to replay attacks, which is iconic 👑 Extra security comes from the fact that no secret information needs to be stored on any system, including the server being protected 🫶
the OTP system protects against external passive attacks against the authentication subsystem 🛡️ It does NOT stop a network eavesdropper from getting into private info, and it doesn't protect against "social engineering" or active attacks [9]. not me being the one who has to remind everyone 💀
3.0 INTRODUCTION 🧚
there are two entities in the operation of the OTP one-time password system 🎀 The generator must produce the right one-time password from the user's secret pass-phrase and from the info in the challenge sent by the server. The server must send a challenge that includes the right generation parameters to the generator, must verify the one-time password it gets, must store the last valid one-time password it received, and must store the matching one-time password sequence number. The server also has to help with changing the user's secret pass-phrase in a secure way 🔥
the OTP generator runs the user's secret pass-phrase, along with a seed it got from the server as part of the challenge, through multiple rounds of a secure hash function to make a one-time password 🌈 After every successful authentication, the number of hash iterations goes down by one. That's how a unique sequence of passwords gets made ✨ The server checks the one-time password from the generator by running the secure hash function once and comparing the result with the previously accepted one-time password 🦋 This technique was first suggested by Leslie Lamport [1] 👑
4.0 REQUIREMENTS TERMINOLOGY 💜
in this document, the words that define how significant each requirement is are usually capitalized 🍓 Here they are:
- MUST: This word or the adjective "REQUIRED" means that the item is an absolute requirement of the specification. 💅
- SHOULD: This word or the adjective "RECOMMENDED" means that there might be valid reasons in particular circumstances to ignore this item, but the full implications should be understood and the case carefully weighed before taking a different course. 🤔
- MAY: This word or the adjective "OPTIONAL" means that this item is truly optional. One vendor might include the item because a particular marketplace requires it or because it enhances the product, for example. Another vendor may omit the same item. 🌸
5.0 SECURE HASH FUNCTION 🔐
the security of the OTP system is based on the non-invertability of a secure hash function 🧠 Such a function has to be tractable to compute in the forward direction, but computationally infeasible to invert. it's giving math genius 🤓
the interfaces are currently defined for three hash algorithms: MD4 [2] and MD5 [6] by Ronald Rivest, and SHA [7] by NIST 🎀 All conforming implementations of both server and generators MUST support MD5. They SHOULD support SHA and MAY also support MD4. Obviously, the generator and server have to use the same algorithm to interoperate 🫶 Other hash algorithms can be specified for use with this system by publishing the appropriate interfaces ✨
the secure hash algorithms above all accept an input of any length and produce a fixed-size output 🦋 The OTP system folds this output down to 64 bits using the algorithms in Appendix A. 64 bits is also the length of the one-time passwords. This is believed to be long enough to be secure and short enough to be entered manually (see below, Form of Output) when necessary 💖
6.0 Generation of One-Time Passwords ✨
okay so this section is where the magic happens 🔮💖 It has three parts. First, everything gets mixed together. Then the secure hash function gets applied a specified number of times. Last, the 64 bit one-time password gets turned into something humans can actually read 🦋
Initial Step
ngl the secret pass-phrase can technically be any length 💅 But to reduce the risk from stuff like exhaustive search or dictionary attacks, character string pass-phrases MUST contain at least 10 characters (see Form of Inputs below). All implementations MUST support a pass-phrases of at least 63 characters. The secret pass-phrase is frequently, but is not required to be, textual information a user types in 🫶
Here's the fun part 🎀 The pass phrase gets concatenated with a seed that the server sends in clear text. The seed is not secret, and that's the whole point! It lets clients use the same secret pass-phrase on multiple machines (with different seeds), and it lets people safely recycle their pass-phrases just by changing the seed. iconic, honestly 👑
The result of the concatenation gets passed through the secure hash function, and then it's reduced to 64 bits using one of the function dependent algorithms shown in Appendix A.
Computation Step
okay this part is giving math-core energy 🧚 The secure hash function gets applied multiple times to the output of the initial step (called S). The first one-time password to be used is made by passing S through the secure hash function a number of times (N) that the user specifies. The next one-time password is made by passing S through the secure hash function N-1 times. So it's like a sequence that counts down 🌈
Now the best bit 💀 An eavesdropper who watched a one-time password go by still couldn't make the next required password, because that would mean inverting the hash function. main character protection fr fr 💜
Form of Inputs
The secret pass-phrase is seen only by the OTP generator. To allow interchangeability of generators, all generators MUST support a secret pass-phrase of 10 to 63 characters. Implementations MAY support a longer pass-phrase, but those implementations risk losing interchangeability with implementations that only support the minimum. not me being the one who checks this 🙈
The seed MUST consist of purely alphanumeric characters, and it MUST be of one to 16 characters in length. The seed is a string of characters that MUST not contain any blanks, and it SHOULD consist of strictly alphanumeric characters from the ISO-646 Invariant Code Set. The seed MUST be case insensitive and MUST be internally converted to lower case before it is processed. the seed is literally so particular and I'm obsessed 🍓
The sequence number and seed together make up a bigger chunk of data called the challenge. The challenge gives the generator everything it needs to work out the correct one-time password from the secret pass-phrase. The challenge MUST be in a standard syntax, so automated generators can spot the challenge in context and pull out these parameters. The syntax of the challenge is:
otp-<algorithm identifier> <sequence integer> <seed>The three tokens MUST be separated by a white space (defined as any number of spaces and/or tabs), and the entire challenge string MUST be terminated with either a space or a new line. The string "otp-" MUST be in lower case. The algorithm identifier is case sensitive (the existing identifiers are all lower case), and the seed is case insensitive and gets converted to lower case before use. 🎀
If additional algorithms are defined, appropriate identifiers (short, but not limited to three or four characters) must be defined. The currently defined algorithm identifiers are:
md4 MD4 Message Digest
md5 MD5 Message Digest
sha1 NIST Secure Hash Algorithm Revision 1Here's an example of an OTP challenge: otp-md5 487 dog2 🦋
Form of Output
The one-time password made by the above procedure is 64 bits long. Typing a 64 bit number is a difficult and error prone process 😭 Some generators pop the password straight into the input stream, some let you cut and paste it, and other setups need it typed in by hand. The OTP system is built to make manual entry easy without getting in the way of automatic methods ✨
So the one-time password MAY be converted to a sequence of six short (1 to 4 letter) easily typed words that only use characters from ISO-646 IVCS, and all servers MUST be capable of accepting it in that form. Each word comes from a dictionary of 2048 words. At 11 bits per word, every one-time password can be encoded 💖
The two extra bits in this encoding store a checksum. The 64 bits of key get broken into pairs of bits, and then those pairs get summed together. The two least significant bits of that sum go into the last two bits of the six word sequence, with the least significant bit of the sum encoded last. All OTP generators MUST calculate this checksum, and all OTP servers MUST verify this checksum explicitly as part of decoding this representation of the one-time password. the checksum is the little bodyguard of this whole system 🛡️
Generators that produce the six-word format MUST present the words in upper case, with single spaces used as separators. All servers MUST accept six-word format without regard to case, and they MUST accept white space used as a separator. The two lines below are the same one-time password. The first one is valid as generator output and as server input, and the second one is only valid as human input to a server 🙈
OUST COAT FOAL MUG BEAK TOTE
oust coat foal mug beak toteInteroperability requires that all OTP servers and generators use the same dictionary. The standard dictionary was first specified in the "S/KEY One Time Password System" described in RFC 1760 [5]. This dictionary is included in this document as Appendix C 📚
To make smaller generators easier to build, hexadecimal output is an acceptable alternative for presenting the one-time password. All implementations of the server software MUST accept case-insensitive hexadecimal as well as six-word format. The hexadecimal digits may be separated by white space, so servers are REQUIRED to ignore all white space. If the representation is partitioned by white space, leading zeros must be retained. Here are some examples of hexadecimal format 🌸
Representation Value
3503785b369cda8b 0x3503785b369cda8b
e5cc a1b8 7c13 096b 0xe5cca1b87c13096b
C7 48 90 F4 27 7B A1 CF 0xc74890f4277ba1cf
47 9 A68 28 4C 9D 0 1BC 0x479a68284c9d01bcAlong with six-word and hexadecimal encodings, servers SHOULD accept the alternate dictionary encoding described in Appendix B. The six words in this encoding MUST not overlap the set of words in the standard dictionary. To avoid confusion with the hexadecimal representation, words in the alternate dictionary MUST not be made up solely of the letters A-F. Decoding these words doesn't need any knowledge of which alternative dictionary was used, so accepting one alternate dictionary means accepting all of them 🧚 Words in the alternative dictionaries are case sensitive, and generators and servers MUST preserve the case when processing these words.
In summary, all conforming servers MUST accept six-word input that uses the Standard Dictionary (RFC 1760 and Appendix C), MUST accept hexadecimal encoding, and SHOULD accept six-word input that uses the Alternative Dictionary technique (Appendix B). There's a remote chance that a hexadecimal encoding of a one-time password looks like a valid six-word standard dictionary encoding, so all implementations MUST use the following scheme. If a six-word encoded one-time password is valid, it gets accepted. Otherwise, if the one-time password can be interpreted as hexadecimal, and that decoding is valid, then it gets accepted. this decoding order is so precise it's giving detective energy 🔍✨
7.0 Verification of One-Time Passwords
okay so an application on the server system that needs OTP authentication is expected to issue an OTP challenge like the one above 💅 Given the parameters from that challenge and the secret pass-phrase, the generator can compute (or look up) the one-time password that gets sent to the server for verification.
The server system keeps a database with, for each user, the one-time password from the last successful authentication, or the first OTP of a newly initialized sequence. To authenticate the user, the server decodes the one-time password it received from the generator into a 64-bit key, then runs that key through the secure hash function once. If the result matches the stored previous OTP, the authentication succeeds, and the accepted one-time password gets stored for future use. the server is literally keeping receipts 🧾💖
8.0 Pass-Phrase Changes
ngl this part is a little sad 🥺 Because the number of hash function applications the generator runs goes down by one each time, at some point the user has to reinitialize the system or they won't be able to authenticate anymore.
Some installations may not let users initialize remotely, but implementations MUST provide a way to do it that does not reveal the user's secret pass-phrase. One option is a means to reinitialize the sequence by explicitly specifying the first one-time password. 🫶
When the sequence of one-time passwords is reinitialized, implementations MUST verify that the seed or the pass-phrase is changed. Installations SHOULD discourage any operation that sends the secret pass-phrase over a network in clear-text, because that practice defeats the whole concept of a one-time password 🙅♀️ sending the pass-phrase in clear text is a no no, bestie 💀
Implementations MAY use the following technique for [re]initialization:
- The user picks a new seed and hash count (default values may be offered). The user provides these, along with the corresponding generated one-time password, to the host system.
- The user MAY also provide the corresponding generated one-time password for count-1 as an error check.
- The user SHOULD provide the generated one-time password for the old seed and old hash count to protect an idle terminal or workstation (this implies that when the count is 1, the user can log in but cannot then change the seed or count). 🔐
In the future, a specific protocol may be defined for reinitialization that will permit smooth and possibly automated interoperation of all hosts and generators. a future protocol that makes everything smooth is giving glow-up 🌈🦋
9.0 PROTECTION AGAINST RACE ATTACK ✨
Okay bestie, this one is serious 😭 All conforming server implementations MUST protect against the race condition in this section. There's an outlined defense you can use, and implementations MAY use that approach or MAY select an alternative defense 🛡️
So here's the drama 👀 An attacker can listen to most of a one-time password, guess the rest, and then race the legit user to finish the authentication 🏃♀️💨 Ngl, multiple guesses at the last word of the six-word format are likely to work 💀
One possible defense is to stop a user from starting multiple simultaneous authentication sessions 🚫 So once the legitimate user has started authenticating, an attacker gets blocked until that first authentication process has completed. Just know that a timeout is necessary to thwart a denial of service attack ⏰
10.0 SECURITY CONSIDERATIONS 🔐
This whole document is about an authentication system that levels up security by limiting the danger of eavesdropping/replay attacks, the ones that have been used against simple password systems [4] 💅
The OTP system only provides protections against passive eavesdropping/replay attacks 😬 It does not provide for the privacy of transmitted data, and it does not provide protection against active attacks. Active attacks against TCP connections are known to be present in the current Internet [9] 💀
The success of the OTP system in protecting host systems is dependent on the non-invertability of the secure hash functions used. To our knowledge, none of the hash algorithms have been broken 🙏 but it is generally believed [6] that MD4 is not as strong as MD5. If a server supports multiple hash algorithms, it is only as secure as the weakest algorithm 🥀
11.0 ACKNOWLEDGMENTS 🫶
Major shoutout to Leslie Lamport 🙌 who first proposed the idea behind OTP authentication [1]. Bellcore's S/KEY system, which OTP is derived from, was proposed by Phil Karn, who also wrote most of the Bellcore reference implementation 🧚
12.0 REFERENCES 📚
Here's the full reading list, no skipping 🎀
- [1] Leslie Lamport, "Password Authentication with Insecure Communication", Communications of the ACM 24.11 (November 1981), 770-772
- [2] Rivest, R., "The MD4 Message-Digest Algorithm, RFC 1320", MIT and RSA Data Security, Inc., April 1992.
- [3] Neil Haller, "The S/KEY One-Time Password System", Proceedings of the ISOC Symposium on Network and Distributed System Security, February 1994, San Diego, CA
- [4] Haller, N., and R. Atkinson, "On Internet Authentication", RFC 1704, Bellcore and Naval Research Laboratory, October 1994.
- [5] Haller, N., "The S/KEY One-Time Password System", RFC 1760, Bellcore, February 1995.
- [6] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, MIT and RSA Data Security, Inc., April 1992.
- [7] National Institute of Standards and Technology (NIST), "Announcing the Secure Hash Standard", FIPS 180-1, U.S. Department of Commerce, April 1995.
- [8] International Standard - Information Processing -- ISO 7-bit coded character set for information interchange (Invariant Code Set), ISO-646, International Standards Organization, Geneva, Switzerland, 1983
- [9] Computer Emergency Response Team (CERT), "IP Spoofing and Hijacked Terminal Connections", CA-95:01, January 1995. Available via anonymous ftp from info.cert.org in /pub/cert_advisories.
13.0 AUTHORS' ADDRESSES 🧑💻
Neil Haller
Bellcore
MCC 1C-265B
445 South Street
Morristown, NJ, 07960-6438, USA
Phone: +1 201 829-4478
Fax: +1 201 829-2504
EMail: nmh@bellcore.comCraig Metz
Kaman Sciences Corporation
For NRL Code 5544
4555 Overlook Avenue, S.W.
Washington, DC, 20375-5337, USA
Phone: +1 202 404-7122
Fax: +1 202 404-7942
EMail: cmetz@cs.nrl.navy.milAppendix A - Interfaces to Secure Hash Algorithms 🔧
MD4 Message Digest (see reference [2])
strcpy(buf,seed);
strcat(buf,passwd);
MDbegin(&md)
MDupdate(&md,(unsigned char *)buf,8*buflen);
/* Fold result to 64 bits */
md.buffer[0] ^= md.buffer[2];
md.buffer[1] ^= md.buffer[3];MD5 Message Digest (see reference [6])
MD5_CTX mdCxt;
strcpy(buf,seed);
strcat(buf,passwd);
/* Crunch the key through MD5 */
MD5Init(&mdCxt);
MD5Update(&mdCxt,(unsigned char *)bits,strlen(bits));
MD5Update(&mdCxt,(unsigned char *)buf,buflen);
MD5Final(&mdCxt);
/* Fold result to 64 bits */
for( i = 0; i < 8; i++ )
result[i] = mdCxt.digest[i] ^ mdCxt.digest[i+8];SHA Secure Hash Algorithm (see reference [7])
/* Fold 160 bit result to 64 bits */
md.buffer[0] ^= md.buffer[2];
md.buffer[1] ^= md.buffer[3];
md.buffer[0] ^= md.buffer[4];Appendix B - Alternative Dictionary Algorithm 🪄
The whole point of alternative dictionary encoding for the OTP is to let you use language specific or friendly words 🌸 Case translation isn't always well defined, so the alternative dictionary encoding is case insensitive. Servers SHOULD accept this encoding in addition to the standard 6-word and hexadecimal encodings 🫶
GENERATOR ENCODING USING AN ALTERNATE DICTIONARY
The standard 6-word encoding uses the placement of a word in the dictionary to represent an 11-bit number. The 64-bit one-time password can then be represented by six words.
An alternative dictionary of 2048 words may be created such that each word W and position of the word in the dictionary N obey the relationship:
alg( W ) % 2048 == Nwhere alg is the hash algorithm used (e.g. MD4, MD5, SHA1).
In addition, no words in the standard dictionary may be chosen 🚫
The generator expands the 64-bit one-time password to 66 bits by computing parity as with the standard 6-word encoding. The six 11-bit numbers are then converted to words using the dictionary that was created such that the above relationship holds ✨
SERVER DECODING OF ALTERNATE DICTIONARY ONE-TIME PASSWORDS
The server accepting alternative dictionary encoding converts each word to an 11-bit number using the above encoding. These numbers are then used in the same way as the decoded standard dictionary words to form the 66-bit one-time password.
The server does not need to have access to the alternate dictionary that was used to create the one-time password it is authenticating. This is because the decoding from word to 11-bit number does not make any use of the dictionary. As a result of the independence of the dictionary, a server accepting one alternate dictionary accept all alternate dictionaries 🦋
Appendix C - Dictionary for Converting Between 6-Word and Binary 📖
Formats 💖
okay so this dictionary comes from the put.c module in the original Bellcore reference distribution 🦋 it's giving OG energy, bestie 🧚 here's the whole word list 💅
{ "A", "ABE", "ACE", "ACT", "AD", "ADA", "ADD",
"AGO", "AID", "AIM", "AIR", "ALL", "ALP", "AM", "AMY",
"AN", "ANA", "AND", "ANN", "ANT", "ANY", "APE", "APS",
"APT", "ARC", "ARE", "ARK", "ARM", "ART", "AS", "ASH",
"ASK", "AT", "ATE", "AUG", "AUK", "AVE", "AWE", "AWK",
"AWL", "AWN", "AX", "AYE", "BAD", "BAG", "BAH", "BAM",
"BAN", "BAR", "BAT", "BAY", "BE", "BED", "BEE", "BEG",
"BEN", "BET", "BEY", "BIB", "BID", "BIG", "BIN", "BIT",
"BOB", "BOG", "BON", "BOO", "BOP", "BOW", "BOY", "BUB",
"BUD", "BUG", "BUM", "BUN", "BUS", "BUT", "BUY", "BY",
"BYE", "CAB", "CAL", "CAM", "CAN", "CAP", "CAR", "CAT",
"CAW", "COD", "COG", "COL", "CON", "COO", "COP", "COT",
"COW", "COY", "CRY", "CUB", "CUE", "CUP", "CUR", "CUT",
"DAB", "DAD", "DAM", "DAN", "DAR", "DAY", "DEE", "DEL",
"DEN", "DES", "DEW", "DID", "DIE", "DIG", "DIN", "DIP",
"DO", "DOE", "DOG", "DON", "DOT", "DOW", "DRY", "DUB",
"DUD", "DUE", "DUG", "DUN", "EAR", "EAT", "ED", "EEL",
"EGG", "EGO", "ELI", "ELK", "ELM", "ELY", "EM", "END",
"EST", "ETC", "EVA", "EVE", "EWE", "EYE", "FAD", "FAN",
"FAR", "FAT", "FAY", "FED", "FEE", "FEW", "FIB", "FIG",
"FIN", "FIR", "FIT", "FLO", "FLY", "FOE", "FOG", "FOR",
"FRY", "FUM", "FUN", "FUR", "GAB", "GAD", "GAG", "GAL",
"GAM", "GAP", "GAS", "GAY", "GEE", "GEL", "GEM", "GET",
"GIG", "GIL", "GIN", "GO", "GOT", "GUM", "GUN", "GUS",
"GUT", "GUY", "GYM", "GYP", "HA", "HAD", "HAL", "HAM",
"HAN", "HAP", "HAS", "HAT", "HAW", "HAY", "HE", "HEM",
"HEN", "HER", "HEW", "HEY", "HI", "HID", "HIM", "HIP",
"HIS", "HIT", "HO", "HOB", "HOC", "HOE", "HOG", "HOP",
"HOT", "HOW", "HUB", "HUE", "HUG", "HUH", "HUM", "HUT",
"I", "ICY", "IDA", "IF", "IKE", "ILL", "INK", "INN",
"IO", "ION", "IQ", "IRA", "IRE", "IRK", "IS", "IT",
"ITS", "IVY", "JAB", "JAG", "JAM", "JAN", "JAR", "JAW",
"JAY", "JET", "JIG", "JIM", "JO", "JOB", "JOE", "JOG",
"JOT", "JOY", "JUG", "JUT", "KAY", "KEG", "KEN", "KEY",
"KID", "KIM", "KIN", "KIT", "LA", "LAB", "LAC", "LAD",
"LAG", "LAM", "LAP", "LAW", "LAY", "LEA", "LED", "LEE",
"LEG", "LEN", "LEO", "LET", "LEW", "LID", "LIE", "LIN",
"LIP", "LIT", "LO", "LOB", "LOG", "LOP", "LOS", "LOT",
"LOU", "LOW", "LOY", "LUG", "LYE", "MA", "MAC", "MAD",
"MAE", "MAN", "MAO", "MAP", "MAT", "MAW", "MAY", "ME",
"MEG", "MEL", "MEN", "MET", "MEW", "MID", "MIN", "MIT",
"MOB", "MOD", "MOE", "MOO", "MOP", "MOS", "MOT", "MOW",
"MUD", "MUG", "MUM", "MY", "NAB", "NAG", "NAN", "NAP",
"NAT", "NAY", "NE", "NED", "NEE", "NET", "NEW", "NIB",
"NIL", "NIP", "NIT", "NO", "NOB", "NOD", "NON", "NOR",
"NOT", "NOV", "NOW", "NU", "NUN", "NUT", "O", "OAF",
"OAK", "OAR", "OAT", "ODD", "ODE", "OF", "OFF", "OFT",
"OH", "OIL", "OK", "OLD", "ON", "ONE", "OR", "ORB",
"ORE", "ORR", "OS", "OTT", "OUR", "OUT", "OVA", "OW",
"OWE", "OWL", "OWN", "OX", "PA", "PAD", "PAL", "PAM",
"PAN", "PAP", "PAR", "PAT", "PAW", "PAY", "PEA", "PEG",
"PEN", "PEP", "PER", "PET", "PEW", "PHI", "PI", "PIE",
"PIN", "PIT", "PLY", "PO", "POD", "POE", "POP", "POT",
"POW", "PRO", "PRY", "PUB", "PUG", "PUN", "PUP", "PUT",
"QUO", "RAG", "RAM", "RAN", "RAP", "RAT", "RAW", "RAY",
"REB", "RED", "REP", "RET", "RIB", "RID", "RIG", "RIM",
"RIO", "RIP", "ROB", "ROD", "ROE", "RON", "ROT", "ROW",
"ROY", "RUB", "RUE", "RUG", "RUM", "RUN", "RYE", "SAC",
"SAD", "SAG", "SAL", "SAM", "SAN", "SAP", "SAT", "SAW",
"SAY", "SEA", "SEC", "SEE", "SEN", "SET", "SEW", "SHE",
"SHY", "SIN", "SIP", "SIR", "SIS", "SIT", "SKI", "SKY",
"SLY", "SO", "SOB", "SOD", "SON", "SOP", "SOW", "SOY",
"SPA", "SPY", "SUB", "SUD", "SUE", "SUM", "SUN", "SUP",
"TAB", "TAD", "TAG", "TAN", "TAP", "TAR", "TEA", "TED",
"TEE", "TEN", "THE", "THY", "TIC", "TIE", "TIM", "TIN",
"TIP", "TO", "TOE", "TOG", "TOM", "TON", "TOO", "TOP",
"TOW", "TOY", "TRY", "TUB", "TUG", "TUM", "TUN", "TWO",
"UN", "UP", "US", "USE", "VAN", "VAT", "VET", "VIE",
"WAD", "WAG", "WAR", "WAS", "WAY", "WE", "WEB", "WED",
"WEE", "WET", "WHO", "WHY", "WIN", "WIT", "WOK", "WON",
"WOO", "WOW", "WRY", "WU", "YAM", "YAP", "YAW", "YE",
"YEA", "YES", "YET", "YOU", "ABED", "ABEL", "ABET", "ABLE",
"ABUT", "ACHE", "ACID", "ACME", "ACRE", "ACTA", "ACTS", "ADAM",
"ADDS", "ADEN", "AFAR", "AFRO", "AGEE", "AHEM", "AHOY", "AIDA",
"AIDE", "AIDS", "AIRY", "AJAR", "AKIN", "ALAN", "ALEC", "ALGA",
"ALIA", "ALLY", "ALMA", "ALOE", "ALSO", "ALTO", "ALUM", "ALVA",
"AMEN", "AMES", "AMID", "AMMO", "AMOK", "AMOS", "AMRA", "ANDY",
"ANEW", "ANNA", "ANNE", "ANTE", "ANTI", "AQUA", "ARAB", "ARCH",
"AREA", "ARGO", "ARID", "ARMY", "ARTS", "ARTY", "ASIA", "ASKS",
"ATOM", "AUNT", "AURA", "AUTO", "AVER", "AVID", "AVIS", "AVON",
"AVOW", "AWAY", "AWRY", "BABE", "BABY", "BACH", "BACK", "BADE",
"BAIL", "BAIT", "BAKE", "BALD", "BALE", "BALI", "BALK", "BALL",
"BALM", "BAND", "BANE", "BANG", "BANK", "BARB", "BARD", "BARE",
"BARK", "BARN", "BARR", "BASE", "BASH", "BASK", "BASS", "BATE",
"BATH", "BAWD", "BAWL", "BEAD", "BEAK", "BEAM", "BEAN", "BEAR",
"BEAT", "BEAU", "BECK", "BEEF", "BEEN", "BEER", "BEET", "BELA",
"BELL", "BELT", "BEND", "BENT", "BERG", "BERN", "BERT", "BESS",
"BEST", "BETA", "BETH", "BHOY", "BIAS", "BIDE", "BIEN", "BILE",
"BILK", "BILL", "BIND", "BING", "BIRD", "BITE", "BITS", "BLAB",
"BLAT", "BLED", "BLEW", "BLOB", "BLOC", "BLOT", "BLOW", "BLUE",
"BLUM", "BLUR", "BOAR", "BOAT", "BOCA", "BOCK", "BODE", "BODY",
"BOGY", "BOHR", "BOIL", "BOLD", "BOLO", "BOLT", "BOMB", "BONA",
"BOND", "BONE", "BONG", "BONN", "BONY", "BOOK", "BOOM", "BOON",
"BOOT", "BORE", "BORG", "BORN", "BOSE", "BOSS", "BOTH", "BOUT",
"BOWL", "BOYD", "BRAD", "BRAE", "BRAG", "BRAN", "BRAY", "BRED",
"BREW", "BRIG", "BRIM", "BROW", "BUCK", "BUDD", "BUFF", "BULB",
"BULK", "BULL", "BUNK", "BUNT", "BUOY", "BURG", "BURL", "BURN",
"BURR", "BURT", "BURY", "BUSH", "BUSS", "BUST", "BUSY", "BYTE",
"CADY", "CAFE", "CAGE", "CAIN", "CAKE", "CALF", "CALL", "CALM",
"CAME", "CANE", "CANT", "CARD", "CARE", "CARL", "CARR", "CART",
"CASE", "CASH", "CASK", "CAST", "CAVE", "CEIL", "CELL", "CENT",
"CERN", "CHAD", "CHAR", "CHAT", "CHAW", "CHEF", "CHEN", "CHEW",
"CHIC", "CHIN", "CHOU", "CHOW", "CHUB", "CHUG", "CHUM", "CITE",
"CITY", "CLAD", "CLAM", "CLAN", "CLAW", "CLAY", "CLOD", "CLOG",
"CLOT", "CLUB", "CLUE", "COAL", "COAT", "COCA", "COCK", "COCO",
"CODA", "CODE", "CODY", "COED", "COIL", "COIN", "COKE", "COLA",
"COLD", "COLT", "COMA", "COMB", "COME", "COOK", "COOL", "COON",
"COOT", "CORD", "CORE", "CORK", "CORN", "COST", "COVE", "COWL",
"CRAB", "CRAG", "CRAM", "CRAY", "CREW", "CRIB", "CROW", "CRUD",
"CUBA", "CUBE", "CUFF", "CULL", "CULT", "CUNY", "CURB", "CURD",
"CURE", "CURL", "CURT", "CUTS", "DADE", "DALE", "DAME", "DANA",
"DANE", "DANG", "DANK", "DARE", "DARK", "DARN", "DART", "DASH",
"DATA", "DATE", "DAVE", "DAVY", "DAWN", "DAYS", "DEAD", "DEAF",
"DEAL", "DEAN", "DEAR", "DEBT", "DECK", "DEED", "DEEM", "DEER",
"DEFT", "DEFY", "DELL", "DENT", "DENY", "DESK", "DIAL", "DICE",
"DIED", "DIET", "DIME", "DINE", "DING", "DINT", "DIRE", "DIRT",
"DISC", "DISH", "DISK", "DIVE", "DOCK", "DOES", "DOLE", "DOLL",
"DOLT", "DOME", "DONE", "DOOM", "DOOR", "DORA", "DOSE", "DOTE",
"DOUG", "DOUR", "DOVE", "DOWN", "DRAB", "DRAG", "DRAM", "DRAW",
"DREW", "DRUB", "DRUG", "DRUM", "DUAL", "DUCK", "DUCT", "DUEL",
"DUET", "DUKE", "DULL", "DUMB", "DUNE", "DUNK", "DUSK", "DUST",
"DUTY", "EACH", "EARL", "EARN", "EASE", "EAST", "EASY", "EBEN",
"ECHO", "EDDY", "EDEN", "EDGE", "EDGY", "EDIT", "EDNA", "EGAN",
"ELAN", "ELBA", "ELLA", "ELSE", "EMIL", "EMIT", "EMMA", "ENDS",
"ERIC", "EROS", "EVEN", "EVER", "EVIL", "EYED", "FACE", "FACT",
"FADE", "FAIL", "FAIN", "FAIR", "FAKE", "FALL", "FAME", "FANG",
"FARM", "FAST", "FATE", "FAWN", "FEAR", "FEAT", "FEED", "FEEL",
"FEET", "FELL", "FELT", "FEND", "FERN", "FEST", "FEUD", "FIEF",
"FIGS", "FILE", "FILL", "FILM", "FIND", "FINE", "FINK", "FIRE",
"FIRM", "FISH", "FISK", "FIST", "FITS", "FIVE", "FLAG", "FLAK",
"FLAM", "FLAT", "FLAW", "FLEA", "FLED", "FLEW", "FLIT", "FLOC",
"FLOG", "FLOW", "FLUB", "FLUE", "FOAL", "FOAM", "FOGY", "FOIL",
"FOLD", "FOLK", "FOND", "FONT", "FOOD", "FOOL", "FOOT", "FORD",
"FORE", "FORK", "FORM", "FORT", "FOSS", "FOUL", "FOUR", "FOWL",
"FRAU", "FRAY", "FRED", "FREE", "FRET", "FREY", "FROG", "FROM",
"FUEL", "FULL", "FUME", "FUND", "FUNK", "FURY", "FUSE", "FUSS",
"GAFF", "GAGE", "GAIL", "GAIN", "GAIT", "GALA", "GALE", "GALL",
"GALT", "GAME", "GANG", "GARB", "GARY", "GASH", "GATE", "GAUL",
"GAUR", "GAVE", "GAWK", "GEAR", "GELD", "GENE", "GENT", "GERM",
"GETS", "GIBE", "GIFT", "GILD", "GILL", "GILT", "GINA", "GIRD",
"GIRL", "GIST", "GIVE", "GLAD", "GLEE", "GLEN", "GLIB", "GLOB",
"GLOM", "GLOW", "GLUE", "GLUM", "GLUT", "GOAD", "GOAL", "GOAT",
"GOER", "GOES", "GOLD", "GOLF", "GONE", "GONG", "GOOD", "GOOF",
"GORE", "GORY", "GOSH", "GOUT", "GOWN", "GRAB", "GRAD", "GRAY",
"GREG", "GREW", "GREY", "GRID", "GRIM", "GRIN", "GRIT", "GROW",
"GRUB", "GULF", "GULL", "GUNK", "GURU", "GUSH", "GUST", "GWEN",
"GWYN", "HAAG", "HAAS", "HACK", "HAIL", "HAIR", "HALE", "HALF",
"HALL", "HALO", "HALT", "HAND", "HANG", "HANK", "HANS", "HARD",
"HARK", "HARM", "HART", "HASH", "HAST", "HATE", "HATH", "HAUL",
"HAVE", "HAWK", "HAYS", "HEAD", "HEAL", "HEAR", "HEAT", "HEBE",
"HECK", "HEED", "HEEL", "HEFT", "HELD", "HELL", "HELM", "HERB",
"HERD", "HERE", "HERO", "HERS", "HESS", "HEWN", "HICK", "HIDE",
"HIGH", "HIKE", "HILL", "HILT", "HIND", "HINT", "HIRE", "HISS",
"HIVE", "HOBO", "HOCK", "HOFF", "HOLD", "HOLE", "HOLM", "HOLT",
"HOME", "HONE", "HONK", "HOOD", "HOOF", "HOOK", "HOOT", "HORN",
"HOSE", "HOST", "HOUR", "HOVE", "HOWE", "HOWL", "HOYT", "HUCK",
"HUED", "HUFF", "HUGE", "HUGH", "HUGO", "HULK", "HULL", "HUNK",
"HUNT", "HURD", "HURL", "HURT", "HUSH", "HYDE", "HYMN", "IBIS",
"ICON", "IDEA", "IDLE", "IFFY", "INCA", "INCH", "INTO", "IONS",
"IOTA", "IOWA", "IRIS", "IRMA", "IRON", "ISLE", "ITCH", "ITEM",
"IVAN", "JACK", "JADE", "JAIL", "JAKE", "JANE", "JAVA", "JEAN",
"JEFF", "JERK", "JESS", "JEST", "JIBE", "JILL", "JILT", "JIVE",
"JOAN", "JOBS", "JOCK", "JOEL", "JOEY", "JOHN", "JOIN", "JOKE",
"JOLT", "JOVE", "JUDD", "JUDE", "JUDO", "JUDY", "JUJU", "JUKE",
"JULY", "JUNE", "JUNK", "JUNO", "JURY", "JUST", "JUTE", "KAHN",
"KALE", "KANE", "KANT", "KARL", "KATE", "KEEL", "KEEN", "KENO",
"KENT", "KERN", "KERR", "KEYS", "KICK", "KILL", "KIND", "KING",
"KIRK", "KISS", "KITE", "KLAN", "KNEE", "KNEW", "KNIT", "KNOB",
"KNOT", "KNOW", "KOCH", "KONG", "KUDO", "KURD", "KURT", "KYLE",
"LACE", "LACK", "LACY", "LADY", "LAID", "LAIN", "LAIR", "LAKE",
"LAMB", "LAME", "LAND", "LANE", "LANG", "LARD", "LARK", "LASS",Okay so here's the rest of the word list, bestie 🎀 every single word is still in place, exactly as it should be ✨
"LAST", "LATE", "LAUD", "LAVA", "LAWN", "LAWS", "LAYS", "LEAD",
"LEAF", "LEAK", "LEAN", "LEAR", "LEEK", "LEER", "LEFT", "LEND",
"LENS", "LENT", "LEON", "LESK", "LESS", "LEST", "LETS", "LIAR",
"LICE", "LICK", "LIED", "LIEN", "LIES", "LIEU", "LIFE", "LIFT",
"LIKE", "LILA", "LILT", "LILY", "LIMA", "LIMB", "LIME", "LIND",
"LINE", "LINK", "LINT", "LION", "LISA", "LIST", "LIVE", "LOAD",
"LOAF", "LOAM", "LOAN", "LOCK", "LOFT", "LOGE", "LOIS", "LOLA",
"LONE", "LONG", "LOOK", "LOON", "LOOT", "LORD", "LORE", "LOSE",
"LOSS", "LOST", "LOUD", "LOVE", "LOWE", "LUCK", "LUCY", "LUGE",
"LUKE", "LULU", "LUND", "LUNG", "LURA", "LURE", "LURK", "LUSH",
"LUST", "LYLE", "LYNN", "LYON", "LYRA", "MACE", "MADE", "MAGI",
"MAID", "MAIL", "MAIN", "MAKE", "MALE", "MALI", "MALL", "MALT",
"MANA", "MANN", "MANY", "MARC", "MARE", "MARK", "MARS", "MART",
"MARY", "MASH", "MASK", "MASS", "MAST", "MATE", "MATH", "MAUL",
"MAYO", "MEAD", "MEAL", "MEAN", "MEAT", "MEEK", "MEET", "MELD",
"MELT", "MEMO", "MEND", "MENU", "MERT", "MESH", "MESS", "MICE",
"MIKE", "MILD", "MILE", "MILK", "MILL", "MILT", "MIMI", "MIND",
"MINE", "MINI", "MINK", "MINT", "MIRE", "MISS", "MIST", "MITE",
"MITT", "MOAN", "MOAT", "MOCK", "MODE", "MOLD", "MOLE", "MOLL",
"MOLT", "MONA", "MONK", "MONT", "MOOD", "MOON", "MOOR", "MOOT",
"MORE", "MORN", "MORT", "MOSS", "MOST", "MOTH", "MOVE", "MUCH",
"MUCK", "MUDD", "MUFF", "MULE", "MULL", "MURK", "MUSH", "MUST",
"MUTE", "MUTT", "MYRA", "MYTH", "NAGY", "NAIL", "NAIR", "NAME",
"NARY", "NASH", "NAVE", "NAVY", "NEAL", "NEAR", "NEAT", "NECK",
"NEED", "NEIL", "NELL", "NEON", "NERO", "NESS", "NEST", "NEWS",
"NEWT", "NIBS", "NICE", "NICK", "NILE", "NINA", "NINE", "NOAH",
"NODE", "NOEL", "NOLL", "NONE", "NOOK", "NOON", "NORM", "NOSE",
"NOTE", "NOUN", "NOVA", "NUDE", "NULL", "NUMB", "OATH", "OBEY",
"OBOE", "ODIN", "OHIO", "OILY", "OINT", "OKAY", "OLAF", "OLDY",
"OLGA", "OLIN", "OMAN", "OMEN", "OMIT", "ONCE", "ONES", "ONLY",
"ONTO", "ONUS", "ORAL", "ORGY", "OSLO", "OTIS", "OTTO", "OUCH",
"OUST", "OUTS", "OVAL", "OVEN", "OVER", "OWLY", "OWNS", "QUAD",
"QUIT", "QUOD", "RACE", "RACK", "RACY", "RAFT", "RAGE", "RAID",
"RAIL", "RAIN", "RAKE", "RANK", "RANT", "RARE", "RASH", "RATE",
"RAVE", "RAYS", "READ", "REAL", "REAM", "REAR", "RECK", "REED",
"REEF", "REEK", "REEL", "REID", "REIN", "RENA", "REND", "RENT",
"REST", "RICE", "RICH", "RICK", "RIDE", "RIFT", "RILL", "RIME",
"RING", "RINK", "RISE", "RISK", "RITE", "ROAD", "ROAM", "ROAR",
"ROBE", "ROCK", "RODE", "ROIL", "ROLL", "ROME", "ROOD", "ROOF",
"ROOK", "ROOM", "ROOT", "ROSA", "ROSE", "ROSS", "ROSY", "ROTH",
"ROUT", "ROVE", "ROWE", "ROWS", "RUBE", "RUBY", "RUDE", "RUDY",
"RUIN", "RULE", "RUNG", "RUNS", "RUNT", "RUSE", "RUSH", "RUSK",
"RUSS", "RUST", "RUTH", "SACK", "SAFE", "SAGE", "SAID", "SAIL",
"SALE", "SALK", "SALT", "SAME", "SAND", "SANE", "SANG", "SANK",
"SARA", "SAUL", "SAVE", "SAYS", "SCAN", "SCAR", "SCAT", "SCOT",
"SEAL", "SEAM", "SEAR", "SEAT", "SEED", "SEEK", "SEEM", "SEEN",
"SEES", "SELF", "SELL", "SEND", "SENT", "SETS", "SEWN", "SHAG",
"SHAM", "SHAW", "SHAY", "SHED", "SHIM", "SHIN", "SHOD", "SHOE",
"SHOT", "SHOW", "SHUN", "SHUT", "SICK", "SIDE", "SIFT", "SIGH",
"SIGN", "SILK", "SILL", "SILO", "SILT", "SINE", "SING", "SINK",
"SIRE", "SITE", "SITS", "SITU", "SKAT", "SKEW", "SKID", "SKIM",
"SKIN", "SKIT", "SLAB", "SLAM", "SLAT", "SLAY", "SLED", "SLEW",
"SLID", "SLIM", "SLIT", "SLOB", "SLOG", "SLOT", "SLOW", "SLUG",
"SLUM", "SLUR", "SMOG", "SMUG", "SNAG", "SNOB", "SNOW", "SNUB",
"SNUG", "SOAK", "SOAR", "SOCK", "SODA", "SOFA", "SOFT", "SOIL",
"SOLD", "SOME", "SONG", "SOON", "SOOT", "SORE", "SORT", "SOUL",
"SOUR", "SOWN", "STAB", "STAG", "STAN", "STAR", "STAY", "STEM",
"STEW", "STIR", "STOW", "STUB", "STUN", "SUCH", "SUDS", "SUIT",
"SULK", "SUMS", "SUNG", "SUNK", "SURE", "SURF", "SWAB", "SWAG",
"SWAM", "SWAN", "SWAT", "SWAY", "SWIM", "SWUM", "TACK", "TACT",
"TAIL", "TAKE", "TALE", "TALK", "TALL", "TANK", "TASK", "TATE",
"TAUT", "TEAL", "TEAM", "TEAR", "TECH", "TEEM", "TEEN", "TEET",
"TELL", "TEND", "TENT", "TERM", "TERN", "TESS", "TEST", "THAN",
"THAT", "THEE", "THEM", "THEN", "THEY", "THIN", "THIS", "THUD",
"THUG", "TICK", "TIDE", "TIDY", "TIED", "TIER", "TILE", "TILL",
"TILT", "TIME", "TINA", "TINE", "TINT", "TINY", "TIRE", "TOAD",
"TOGO", "TOIL", "TOLD", "TOLL", "TONE", "TONG", "TONY", "TOOK",
"TOOL", "TOOT", "TORE", "TORN", "TOTE", "TOUR", "TOUT", "TOWN",
"TRAG", "TRAM", "TRAY", "TREE", "TREK", "TRIG", "TRIM", "TRIO",
"TROD", "TROT", "TROY", "TRUE", "TUBA", "TUBE", "TUCK", "TUFT",
"TUNA", "TUNE", "TUNG", "TURF", "TURN", "TUSK", "TWIG", "TWIN",
"TWIT", "ULAN", "UNIT", "URGE", "USED", "USER", "USES", "UTAH",
"VAIL", "VAIN", "VALE", "VARY", "VASE", "VAST", "VEAL", "VEDA",
"VEIL", "VEIN", "VEND", "VENT", "VERB", "VERY", "VETO", "VICE",
"VIEW", "VINE", "VISE", "VOID", "VOLT", "VOTE", "WACK", "WADE",
"WAGE", "WAIL", "WAIT", "WAKE", "WALE", "WALK", "WALL", "WALT",
"WAND", "WANE", "WANG", "WANT", "WARD", "WARM", "WARN", "WART",
"WASH", "WAST", "WATS", "WATT", "WAVE", "WAVY", "WAYS", "WEAK",
"WEAL", "WEAN", "WEAR", "WEED", "WEEK", "WEIR", "WELD", "WELL",
"WELT", "WENT", "WERE", "WERT", "WEST", "WHAM", "WHAT", "WHEE",
"WHEN", "WHET", "WHOA", "WHOM", "WICK", "WIFE", "WILD", "WILL",
"WIND", "WINE", "WING", "WINK", "WINO", "WIRE", "WISE", "WISH",
"WITH", "WOLF", "WONT", "WOOD", "WOOL", "WORD", "WORE", "WORK",
"WORM", "WORN", "WOVE", "WRIT", "WYNN", "YALE", "YANG", "YANK",
"YARD", "YARN", "YAWL", "YAWN", "YEAH", "YEAR", "YELL", "YOGA",
"YOKE" };📦 where this page comes from
- ietf: rfc1938 1996-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms