RFC 2289

A One-Time Password System

📅 published February 1998, from ietf

1.0 ABSTRACT ✨

okay so this doc describes a one-time password authentication system (OTP) 🔐 It handles system access (login) and other apps that need authentication, and it's built to stay secure against passive attacks that replay captured reusable passwords 💅 OTP grew out of the S/KEY (S/KEY is a trademark of Bellcore) One-Time Password System that Bellcore released, which you can read about in references [3] and [5] 🌸

2.0 OVERVIEW

ngl this one is a whole vibe 🦋 One attack on networked systems is eavesdropping on connections to snatch login IDs and passwords from legit users. Once that info is captured, the attacker can use it later to get in. One-time password systems exist to shut that down, and the attack they counter is called a "replay attack" [4] 🍓

The authentication system here uses a secret pass-phrase to generate a sequence of one-time (single use) passwords ✨ The big slay: the user's secret pass-phrase never has to cross the network, not during authentication and not during pass-phrase changes. So it's not vulnerable to replay attacks 🙈 It gets extra security from the fact that no secret info has to be stored on any system, including the server being protected 🔥

The OTP system protects against external passive attacks on the authentication subsystem. It does not stop a network eavesdropper from getting into private info, and it does not protect against "social engineering" or active attacks [9] 💀 so don't get it twisted, it's not a full security blanket 🫶

3.0 INTRODUCTION

There are two entities in the OTP one-time password system, bestie 👑 The generator has to produce the right one-time password from the user's secret pass-phrase and from the info in the challenge sent by the server. The server must send a challenge that includes the correct generation parameters to the generator, must verify the one-time password it receives, must store the last valid one-time password it got, and must store the matching one-time password sequence number. The server must also help with changing the user's secret pass-phrase in a secure way 🎀

Here's the mechanics: the OTP generator runs the user's secret pass-phrase, plus a seed the server sent in the challenge, through multiple rounds of a secure hash function to get a one-time password 🧚 After each successful authentication, the number of hash iterations goes down by one. That's how a unique sequence of passwords gets made 🌈 The server checks a received one-time password by running the secure hash function once and comparing the result to the last accepted one-time password. Lowkey genius. This technique was first suggested by Leslie Lamport [1] ✨

4.0 REQUIREMENTS TERMINOLOGY

In this doc, the words that set how important each requirement is are usually capitalized 💖 Here they are:

  • MUST

This word, or the adjective "REQUIRED", means the item is an absolute requirement of the specification. No skipping 😤

  • SHOULD

This word, or the adjective "RECOMMENDED", means there might be valid reasons in particular circumstances to ignore the item. But you need to understand the full implications and think it through carefully before going a different way 🤔

  • MAY

This word, or the adjective "OPTIONAL", means the item is truly optional. One vendor might include it because a marketplace needs it or because it makes the product better, for example. Another vendor might leave the same item out 🌸

5.0 SECURE HASH FUNCTION

The security of the OTP system is based on the non-invertability of a secure hash function 🔐 That kind of function has to be easy to compute in the forward direction, but computationally infeasible to invert. Main character energy 👑

The interfaces are defined for three hash algorithms right now: MD4 [2] and MD5 [6] by Ronald Rivest, and SHA [7] by NIST 🦋 All conforming implementations of both server and generators MUST support MD5. They SHOULD support SHA and MAY also support MD4 ✨ The generator and server have to use the same algorithm to interoperate, obviously 🙃 Other hash algorithms can be specified for use with this system by publishing the appropriate interfaces 🍓

The secure hash algorithms above all accept an input of arbitrary length and produce a fixed-size output. The OTP system folds that output down to 64 bits using the algorithms in Appendix A 🧚 64 bits is also the length of the one-time passwords. It's believed to be long enough to be secure and short enough to type in by hand (see below, Form of Output) when needed 💜

6.0 GENERATION OF ONE-TIME PASSWORDS 🔥

okay so this is where the magic happens ✨ this section explains how the one-time passwords actually get made. there are three bits: everything gets mixed together in an initial step, the secure hash function runs a set number of times in a computation step, and then an output function turns the 64 bit one-time password into something humans can read 💅

Appendix C has example outputs for a bunch of inputs, so implementors can check that their version of these algorithms is doing the right thing 🫶

Initial Step

in principle the user's secret pass-phrase can be any length 🧚 but to cut down the risk from stuff like exhaustive search or dictionary attacks, character string pass-phrases MUST contain at least 10 characters (see Form of Inputs below). every implementation MUST support a pass-phrases of at least 63 characters 💪 the secret pass-phrase is usually text a user types in, but it doesn't have to be 🌸

next, the pass-phrase gets concatenated with a seed that the server sends in clear text. the seed isn't secret, and that's the whole point 🦋 it lets clients use the same secret pass-phrase on multiple machines (each with a different seed), and it lets them safely recycle their pass-phrase by changing the seed.

the result of the concatenation goes through the secure hash function, then gets reduced to 64 bits using one of the function dependent algorithms in Appendix A 🎀

Computation Step

okay the fun part 🌈 a sequence of one-time passwords is made by running the secure hash function over and over on the output of the initial step (we call that S). the first one-time password you use is S run through the hash function N times, where N is the number the user picks. the next one is S run through it N-1 times, and so on. an eavesdropper who watched a one-time password go by still can't make the next one, because that would mean inverting the hash function 🙈 literally a locked door 💀

Form of Inputs

the secret pass-phrase is only ever seen by the OTP generator 🔐 so that generators can be swapped for each other, all generators MUST support a secret pass-phrase of 10 to 63 characters. implementations MAY support a longer pass-phrase, but those risk losing interchangeability with implementations that only do the minimum 👀

the seed MUST consist of purely alphanumeric characters and MUST be of one to 16 characters in length. the seed is a string of characters that MUST not contain any blanks and SHOULD consist of strictly alphanumeric characters from the ISO-646 Invariant Code Set. the seed MUST be case insensitive and MUST be internally converted to lower case before it is processed ✨

the sequence number and seed together make up a larger unit called the challenge 🧩 the challenge gives the generator the parameters it needs to calculate the correct one-time password from the secret pass-phrase. the challenge MUST be in a standard syntax so automated generators can recognize it in context and extract those parameters. the syntax is:

        otp-<algorithm identifier> <sequence integer> <seed>

the three tokens MUST be separated by a white space (defined as any number of spaces and/or tabs), and the entire challenge string MUST be terminated with either a space or a new line. the string "otp-" MUST be in lower case. the algorithm identifier is case sensitive (the existing ones are all lower case), and the seed is case insensitive and converted to lower case before use. if additional algorithms are defined, appropriate identifiers (short, but not limited to three or four characters) must be defined. the currently defined algorithm identifiers are:

    md4        MD4 Message Digest
    md5        MD5 Message Digest
    sha1       NIST Secure Hash Algorithm Revision 1

an example of an OTP challenge is otp-md5 487 dog2 🍓

Form of Output

the one-time password made by the procedure above is 64 bits long. typing a 64 bit number is hard and super easy to mess up 😭 some generators jam it into the input stream, some let you cut and paste it, and others need manual entry. the OTP system is built to make manual entry easier without getting in the way of automatic methods. so the one-time password MAY be converted to, and all servers MUST be capable of accepting it as, a sequence of six short (1 to 4 letter) easy-to-type words that only use characters from ISO-646 IVCS. each word is picked from a dictionary of 2048 words, and at 11 bits per word, every one-time password can be encoded 🎀

the two extra bits in this encoding store a checksum 🧮 the 64 bits get broken into pairs of bits, and those pairs get summed together. the two least significant bits of that sum get encoded in the last two bits of the six word sequence, with the least significant bit of the sum as the last bit encoded. all OTP generators MUST calculate this checksum, and all OTP servers MUST verify this checksum explicitly as part of decoding the one-time password.

generators that produce the six-word format MUST present the words in upper case with single spaces used as separators. all servers MUST accept six-word format without regard to case and white space used as a separator. the two lines below represent the same one-time password. the first is valid as output from a generator and as input to a server, and the second is valid only as human input to a server 🦋

    OUST COAT FOAL MUG BEAK TOTE
    oust coat foal  mug  beak  tote

interoperability requires that all OTP servers and generators use the same dictionary 📚 the standard dictionary was originally specified in the "S/KEY One Time Password System" described in RFC 1760 [5]. this dictionary is included in this document as Appendix D.

hexadecimal output is an acceptable alternative for presenting the one-time password, which is handy for smaller generators 🧚 all implementations of the server software MUST accept case-insensitive hexadecimal as well as six-word format. the hexadecimal digits may be separated by white space, so servers are REQUIRED to ignore all white space. if the representation is partitioned by white space, leading zeros must be retained. here are examples of hexadecimal format:

      Representation                Value

      3503785b369cda8b              0x3503785b369cda8b
      e5cc a1b8 7c13 096b           0xe5cca1b87c13096b
      C7 48 90 F4 27 7B A1 CF       0xc74890f4277ba1cf
      47 9 A68 28 4C 9D 0 1BC       0x479a68284c9d01bc

in addition to accepting six-word and hexadecimal encodings of the 64 bit one-time password, servers SHOULD accept the alternate dictionary encoding described in Appendix B 🌈 the six words in this encoding MUST not overlap the set of words in the standard dictionary. to avoid ambiguity with the hexadecimal representation, words in the alternate dictionary MUST not be comprised solely of the letters A-F. decoding words encoded this way doesn't require any knowledge of the alternative dictionary used, so accepting any alternate dictionary implies accepting all alternate dictionaries. words in the alternative dictionaries are case sensitive, and generators and servers MUST preserve the case in the processing of these words.

the big summary: all conforming servers MUST accept six-word input that uses the Standard Dictionary (RFC 1760 and Appendix D), MUST accept hexadecimal encoding, and SHOULD accept six-word input that uses the Alternative Dictionary technique (Appendix B). there's a remote possibility that a hexadecimal encoding looks like a valid six-word standard dictionary encoding, so all implementations MUST use the following scheme. if a six-word encoded one-time password is valid, it is accepted. otherwise, if the one-time password can be interpreted as hexadecimal, and with that decoding it is valid, then it is accepted. 🔥

7.0 VERIFICATION OF ONE-TIME PASSWORDS ✨

an application on the server system that requires OTP authentication is expected to issue an OTP challenge as described above 🔐 given the parameters from that challenge and the secret pass-phrase, the generator can compute (or look up) the one-time password that gets passed to the server to be verified.

the server system has a database containing, for each user, the one-time password from the last successful authentication, or the first OTP of a newly initialized sequence 🗂️ to authenticate the user, the server decodes the one-time password received from the generator into a 64-bit key, then runs this key through the secure hash function once. if the result matches the stored previous OTP, the authentication is successful and the accepted one-time password is stored for future use 👑

8.0 PASS-PHRASE CHANGES 🎀

because the number of hash function applications executed by the generator decreases by one each time, at some point the user must reinitialize the system or be unable to authenticate 😭

although some installations may not permit users to initialize remotely, implementations MUST provide a means to do so that does not reveal the user's secret pass-phrase 🙈 one way is to provide a means to reinitialize the sequence through explicit specification of the first one-time password.

when the sequence of one-time passwords is reinitialized, implementations MUST verify that the seed or the pass-phrase is changed. installations SHOULD discourage any operation that sends the secret pass-phrase over a network in clear-text, because that practice defeats the concept of a one-time password 💅

implementations MAY use the following technique for [re]initialization 🦋

  • the user picks a new seed and hash count (default values may be offered). the user provides these, along with the corresponding generated one-time password, to the host system.
  • the user MAY also provide the corresponding generated one time password for count-1 as an error check.
  • the user SHOULD provide the generated one-time password for the old seed and old hash count to protect an idle terminal or workstation (this implies that when the count is 1, the user can log in but cannot then change the seed or count).

in the future, a specific protocol may be defined for reinitialization that will permit smooth and possibly automated interoperation of all hosts and generators 🌸

9.0 Protection Against Race Attack 🔥

okay bestie, this one is serious 😭 All conforming server implementations MUST protect against the race condition described here. A defense is outlined below, and implementations MAY use that approach or MAY pick a different defense instead ✨

It's totally possible for an attacker to listen in on most of a one-time password, guess the rest, and then race the real user to finish the login 💀 Guessing the last word of the six-word format is especially likely to pay off for them 🙈

One possible fix is to stop a user from starting several login sessions at once 🛡️ So once the legit user has started authenticating, the attacker gets blocked until that first session finishes. With this approach you also need a timeout, so that an attacker can't use it to cause a denial of service 🫶

10.0 Security Considerations 🔐

Heads up, this section is important! 💅

This whole document is about an authentication system that makes things safer by limiting the danger of eavesdropping and replay attacks, which have been used against simple password systems [4] 🦋

The OTP system only protects against passive eavesdropping and replay attacks. It does not provide privacy for transmitted data, and it does not protect against active attacks like session hijacking, which are known to exist on today's Internet [9] 😭 IP Security (IPsec), see [10], [11], and [12] is recommended to protect against TCP session hijacking 🔒

The OTP system only keeps host systems safe if the secure hash functions it uses are non-invertible 🧠 As far as we know, none of the hash algorithms have been broken. Still, it's generally believed [6] that MD4 is not as strong as MD5 👀 Also, if a server supports multiple hash algorithms, it's only as secure as its weakest algorithm ⚠️

11.0 Acknowledgments 🫶

The idea behind OTP authentication was first proposed by Leslie Lamport [1] 🧚 Bellcore's S/KEY system, which OTP is derived from, was proposed by Phil Karn 🌸 Phil also wrote most of the Bellcore reference implementation 👑

12.0 References 📚

  • [1] Leslie Lamport, "Password Authentication with Insecure Communication", Communications of the ACM 24.11 (November 1981), 770-772
  • [2] Rivest, R., "The MD4 Message-Digest Algorithm", RFC 1320, April 1992.
  • [3] Neil Haller, "The S/KEY One-Time Password System", Proceedings of the ISOC Symposium on Network and Distributed System Security, February 1994, San Diego, CA
  • [4] Haller, N., and R. Atkinson, "On Internet Authentication", RFC 1704, October 1994.
  • [5] Haller, N., "The S/KEY One-Time Password System", RFC 1760, February 1995.
  • [6] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April 1992.
  • [7] National Institute of Standards and Technology (NIST), "Announcing the Secure Hash Standard", FIPS 180-1, U.S. Department of Commerce, April 1995.
  • [8] International Standard - Information Processing -- ISO 7-bit coded character set for information interchange (Invariant Code Set), ISO-646, International Standards Organization, Geneva, Switzerland, 1983
  • [9] Computer Emergency Response Team (CERT), "IP Spoofing and Hijacked Terminal Connections", CA-95:01, January 1995. Available via anonymous ftp from info.cert.org in /pub/cert_advisories.
  • [10] Atkinson, R., "Security Architecture for the Internet Protocol", RFC 1825, August 1995.
  • [11] Atkinson, R., "IP Authentication Header", RFC 1826, August 1995.
  • [12] Atkinson, R., "IP Encapsulating Security Payload (ESP)", RFC 1827, August 1995.

13.0 Authors' Addresses 🎀

Here are the authors' addresses, exactly as they were written 💖

Neil Haller
Bellcore
MCC 1C-265B
445 South Street
Morristown, NJ, 07960-6438, USA

Phone: +1 201 829-4478
Fax:   +1 201 829-2504
EMail: nmh@bellcore.com
Craig Metz
Kaman Sciences Corporation
For NRL Code 5544
4555 Overlook Avenue, S.W.
Washington, DC, 20375-5337, USA

Phone: +1 202 404-7122
Fax:   +1 202 404-7942
EMail: cmetz@cs.nrl.navy.mil
Philip J. Nesser II
Nesser & Nesser Consulting
13501 100th Ave NE
Suite 5202
Kirkland, WA 98034, USA

Phone: +1 206 481 4303
EMail: pjnesser@martigny.ai.mit.edu
Mike Straw
Bellcore
RRC 1A-225
445 Hoes Lane
Piscataway, NJ 08854-4182

Phone:  +1 908 699-5212
EMail:  mess@bellcore.com

Appendix A - Interfaces to Secure Hash Algorithms 🧚

Okay, the original interoperability tests were super valuable 🔥 They showed how tricky it is to turn protocol specs into running code. The big issue is handling bit-ordered data, which depends on the hardware architecture, specifically how a computer stores multi-byte data. This is usually called big or little "endian." A big endian machine stores the most significant byte first, and a little endian machine stores the least significant byte first. So on a big endian machine, data is stored left to right, while little endian machines store it right to left 💅

For example, the four byte value 0x11AABBCC is stored on a big endian machine as the four bytes "0x11", "0xAA", "0xBB", and "0xCC". On a little endian machine, the same value is stored as "0xCC", "0xBB", "0xAA", and "0x11" ✨

For historical reasons, and to promote interoperability with existing implementations, it was decided that ALL hashes incorporated into the OTP protocol MUST store the output of their hash function in LITTLE ENDIAN format BEFORE the bit folding to 64 bits occurs. This is done in the implementations of MD4 and MD5 (see references [2] and [6]), while it must be explicitly done for the implementation of SHA1 (see reference [7]) 🌈

Any future hash functions implemented into the OTP protocol SHOULD provide a similar reference fragment of code, so independent implementations can operate successfully 🫶

MD4 Message Digest (see reference [2])

MD4_CTX md;
unsigned char result[16];

strcpy(buf, seed);     /* seed must be in lower case */
strcat(buf, passwd);
MD4Init(&md);
MD4Update(&md, (unsigned char *)buf, strlen(buf));
MD4Final(result, &md);

/* Fold the 128 bit result to 64 bits */
for (i = 0; i < 8; i++)
        result[i] ^= result[i+8];

MD5 Message Digest (see reference [6])

MD5_CTX md;
unsigned char result[16];
strcpy(buf, seed);     /* seed must be in lower case */
strcat(buf, passwd);
MD5Init(&md);
MD5Update(&md, (unsigned char *)buf, strlen(buf));
MD5Final(result, &md);

/* Fold the 128 bit result to 64 bits */
for (i = 0; i < 8; i++)
        result[i] ^= result[i+8];

SHA Secure Hash Algorithm (see reference [7])

SHA_INFO sha;
unsigned char result[16];
strcpy(buf, seed);     /* seed must be in lower case */
strcat(buf, passwd);
sha_init(&sha);
sha_update(&sha, (unsigned char *)buf, strlen(buf));
sha_final(&sha);       /* NOTE:  no result buffer */

/* Fold the 160 bit result to 64 bits */
sha.digest[0] ^= sha.digest[2];
sha.digest[1] ^= sha.digest[3];
sha.digest[0] ^= sha.digest[4];

/*
 * copy the resulting 64 bits to the result buffer in little endian
 * fashion (analogous to the way MD4Final() and MD5Final() do).
 */
for (i = 0, j = 0; j < 8; i++, j += 4)
{
        result[j]   = (unsigned char)(sha.digest[i] & 0xff);
        result[j+1] = (unsigned char)((sha.digest[i] >> 8) & 0xff);
        result[j+2] = (unsigned char)((sha.digest[i] >> 16) & 0xff);
        result[j+3] = (unsigned char)((sha.digest[i] >> 24) & 0xff);
}

Appendix B - Alternative Dictionary Algorithm 🦋

So the point of the alternative dictionary encoding is to let people use language-specific or friendlier words 💖 Case translation isn't always well defined, so this encoding is case sensitive. Servers SHOULD accept this encoding in addition to the standard 6-word and hexadecimal encodings ✨

GENERATOR ENCODING USING AN ALTERNATE DICTIONARY

Quick recap: the standard 6-word encoding uses where a word sits in the dictionary to represent an 11-bit number, so a 64-bit one-time password can be shown as six words 🧠

An alternative dictionary of 2048 words can be created so that each word W and its position N in the dictionary follow this rule:

alg( W ) % 2048 == N

Here, alg is the hash algorithm being used (for example MD4, MD5, or SHA1). On top of that, none of the words in the standard dictionary may be chosen 🙅‍♀️

The generator expands the 64-bit one-time password to 66 bits by computing parity, just like the standard 6-word encoding does. Then the six 11-bit numbers get converted to words using the dictionary that was built so the rule above holds 🌸

SERVER DECODING OF ALTERNATE DICTIONARY ONE-TIME PASSWORDS

The server that accepts the alternative dictionary encoding converts each word back into an 11-bit number using the rule above. Those numbers are then used the same way as decoded standard dictionary words, to form the 66-bit one-time password 🧚

The server doesn't need access to the alternate dictionary that was used to create the one-time password it's checking. That's because decoding a word into its 11-bit number never uses the dictionary at all 🙈 Since the dictionary doesn't matter here, a server that accepts one alternate dictionary accepts all alternate dictionaries 👑

Appendix C - OTP Verification Examples 🌈

This appendix gives a bunch of inputs and correct outputs for all three defined OTP cryptographic hashes: MD4, MD5, and SHA1 🎀 Developers can use it for interoperability checks when they're building generators or servers. Output is shown in both hexadecimal notation and the six word encoding documented in Appendix D 💅

GENERAL CHECKS ✨

Heads up: the output for these checks isn't meant to be taken literally. It describes the type of action that should be taken 👀

Pass Phrase Length

Input:
  Pass Phrase: Too_short
  Seed: iamvalid
  Count: 99
  Hash: ANY
Output:
  ERROR:  Pass Phrase too short
Input:
  Pass Phrase:
    1234567890123456789012345678901234567890123456789012345678901234
  Seed: iamvalid
  Count: 99
  Hash: ANY
Output:
  WARNING: Pass Phrase longer than the recommended maximum length of
63

Seed Values

Input:
  Pass Phrase:  A_Valid_Pass_Phrase
  Seed: Length_Okay
  Count: 99
  Hash: ANY
Output:
  ERROR: Seed must be purely alphanumeric
Input:
  Pass Phrase:  A_Valid_Pass_Phrase
  Seed: LengthOfSeventeen
  Count: 99
  Hash: ANY

Output:
  ERROR: Seed must be between 1 and 16 characters in length
Input:
  Pass Phrase:  A_Valid_Pass_Phrase
  Seed: A Seed
  Count: 99
  Hash: ANY
Output:
  ERROR: Seed must not contain any spaces

Parity Calculations

Input:
  Pass Phrase: A_Valid_Pass_Phrase
  Seed: AValidSeed
  Count: 99
  Hash: MD5
Output:
  Hex: 85c43ee03857765b
  Six Word(CORRECT):          FOWL KID MASH DEAD DUAL OAF
  Six Word(INCORRECT PARITY): FOWL KID MASH DEAD DUAL NUT
  Six Word(INCORRECT PARITY): FOWL KID MASH DEAD DUAL O
  Six Word(INCORRECT PARITY): FOWL KID MASH DEAD DUAL OAK

MD4 ENCODINGS 💖

Pass Phrase     Seed    Cnt Hex                 Six Word Format

Okay bestie, the MD4 test vectors keep going, and they're giving 🎀✨

========================================================================
This is a test. TeSt     0  D185 4218 EBBB 0B51
                                           ROME MUG FRED SCAN LIVE LACE
This is a test. TeSt     1  6347 3EF0 1CD0 B444
                                           CARD SAD MINI RYE COL KIN
This is a test. TeSt    99  C5E6 1277 6E6C 237A
                                           NOTE OUT IBIS SINK NAVE MODE
AbCdEfGhIjK     alpha1   0  5007 6F47 EB1A DE4E
                                           AWAY SEN ROOK SALT LICE MAP
AbCdEfGhIjK     alpha1   1  65D2 0D19 49B5 F7AB
                                           CHEW GRIM WU HANG BUCK SAID
AbCdEfGhIjK     alpha1  99  D150 C82C CE6F 62D1
                                           ROIL FREE COG HUNK WAIT COCA
OTP's are good  correct  0  849C 79D4 F6F5 5388
                                           FOOL STEM DONE TOOL BECK NILE
OTP's are good  correct  1  8C09 92FB 2508 47B1
                                           GIST AMOS MOOT AIDS FOOD SEEM
OTP's are good  correct 99  3F3B F4B4 145F D74B
                                           TAG SLOW NOV MIN WOOL KENO

MD5 ENCODINGS ✨

Okay so the MD5 set is up next, and the vibes are immaculate 💅

Pass Phrase     Seed    Cnt Hex                 Six Word Format
========================================================================
This is a test. TeSt     0  9E87 6134 D904 99DD
                                           INCH SEA ANNE LONG AHEM TOUR
This is a test. TeSt     1  7965 E054 36F5 029F
                                           EASE OIL FUM CURE AWRY AVIS
This is a test. TeSt    99  50FE 1962 C496 5880
                                           BAIL TUFT BITS GANG CHEF THY
AbCdEfGhIjK     alpha1   0  8706 6DD9 644B F206
                                           FULL PEW DOWN ONCE MORT ARC
AbCdEfGhIjK     alpha1   1  7CD3 4C10 40AD D14B
                                           FACT HOOF AT FIST SITE KENT
AbCdEfGhIjK     alpha1  99  5AA3 7A81 F212 146C
                                           BODE HOP JAKE STOW JUT RAP
OTP's are good  correct  0  F205 7539 43DE 4CF9
                                           ULAN NEW ARMY FUSE SUIT EYED
OTP's are good  correct  1  DDCD AC95 6F23 4937
                                           SKIM CULT LOB SLAM POE HOWL
OTP's are good  correct 99  B203 E28F A525 BE47
                                           LONG IVY JULY AJAR BOND LEE

SHA1 ENCODINGS 🦋

And now the SHA1 set, which is literally the next iconic lineup 🌸

Pass Phrase     Seed    Cnt Hex                 Six Word Format
========================================================================
This is a test. TeSt     0  BB9E 6AE1 979D 8FF4
                                           MILT VARY MAST OK SEES WENT
This is a test. TeSt     1  63D9 3663 9734 385B
                                           CART OTTO HIVE ODE VAT NUT
This is a test. TeSt    99  87FE C776 8B73 CCF9
                                           GAFF WAIT SKID GIG SKY EYED
AbCdEfGhIjK     alpha1   0  AD85 F658 EBE3 83C9
                                           LEST OR HEEL SCOT ROB SUIT
AbCdEfGhIjK     alpha1   1  D07C E229 B5CF 119B
                                           RITE TAKE GELD COST TUNE RECK
AbCdEfGhIjK     alpha1  99  27BC 7103 5AAF 3DC6
                                           MAY STAR TIN LYON VEDA STAN
OTP's are good  correct  0  D51F 3E99 BF8E 6F0B
                                           RUST WELT KICK FELL TAIL FRAU
OTP's are good  correct  1  82AE B52D 9437 74E4
                                           FLIT DOSE ALSO MEW DRUM DEFY
OTP's are good  correct 99  4F29 6A74 FE15 67EC
                                           AURA ALOE HURL WING BERG WAIT

Appendix D - Dictionary for Converting Between 6-Word and Binary Formats 💜

This dictionary is from the module put.c in the original Bellcore reference distribution, so it's giving old-school legend energy 🧚

{        "A",     "ABE",   "ACE",   "ACT",   "AD",    "ADA",   "ADD",
"AGO",   "AID",   "AIM",   "AIR",   "ALL",   "ALP",   "AM",    "AMY",
"AN",    "ANA",   "AND",   "ANN",   "ANT",   "ANY",   "APE",   "APS",
"APT",   "ARC",   "ARE",   "ARK",   "ARM",   "ART",   "AS",    "ASH",
"ASK",   "AT",    "ATE",   "AUG",   "AUK",   "AVE",   "AWE",   "AWK",
"AWL",   "AWN",   "AX",   "AYE",   "BAD",   "BAG",   "BAH",   "BAM",
"BAN",   "BAR",   "BAT",   "BAY",   "BE",    "BED",   "BEE",   "BEG",
"BEN",   "BET",   "BEY",   "BIB",   "BID",   "BIG",   "BIN",   "BIT",
"BOB",   "BOG",   "BON",   "BOO",   "BOP",   "BOW",   "BOY",   "BUB",
"BUD",   "BUG",   "BUM",   "BUN",   "BUS",   "BUT",   "BUY",   "BY",
"BYE",   "CAB",   "CAL",   "CAM",   "CAN",   "CAP",   "CAR",   "CAT",
"CAW",   "COD",   "COG",   "COL",   "CON",   "COO",   "COP",   "COT",
"COW",   "COY",   "CRY",   "CUB",   "CUE",   "CUP",   "CUR",   "CUT",
"DAB",   "DAD",   "DAM",   "DAN",   "DAR",   "DAY",   "DEE",   "DEL",
"DEN",   "DES",   "DEW",   "DID",   "DIE",   "DIG",   "DIN",   "DIP",
"DO",    "DOE",   "DOG",   "DON",   "DOT",   "DOW",   "DRY",   "DUB",
"DUD",   "DUE",   "DUG",   "DUN",   "EAR",   "EAT",   "ED",    "EEL",
"EGG",   "EGO",   "ELI",   "ELK",   "ELM",   "ELY",   "EM",    "END",
"EST",   "ETC",   "EVA",   "EVE",   "EWE",   "EYE",   "FAD",   "FAN",
"FAR",   "FAT",   "FAY",   "FED",   "FEE",   "FEW",   "FIB",   "FIG",
"FIN",   "FIR",   "FIT",   "FLO",   "FLY",   "FOE",   "FOG",   "FOR",
"FRY",   "FUM",   "FUN",   "FUR",   "GAB",   "GAD",   "GAG",   "GAL",
"GAM",   "GAP",   "GAS",   "GAY",   "GEE",   "GEL",   "GEM",   "GET",
"GIG",   "GIL",   "GIN",   "GO",    "GOT",   "GUM",   "GUN",   "GUS",
"GUT",   "GUY",   "GYM",   "GYP",   "HA",    "HAD",   "HAL",   "HAM",
"HAN",   "HAP",   "HAS",   "HAT",   "HAW",   "HAY",   "HE",    "HEM",
"HEN",   "HER",   "HEW",   "HEY",   "HI",    "HID",   "HIM",   "HIP",
"HIS",   "HIT",   "HO",   "HOB",   "HOC",   "HOE",   "HOG",   "HOP",
"HOT",   "HOW",   "HUB",   "HUE",   "HUG",   "HUH",   "HUM",   "HUT",
"I",     "ICY",   "IDA",   "IF",    "IKE",   "ILL",   "INK",   "INN",
"IO",    "ION",   "IQ",   "IRA",   "IRE",   "IRK",   "IS",    "IT",
"ITS",   "IVY",   "JAB",   "JAG",   "JAM",   "JAN",   "JAR",   "JAW",
"JAY",   "JET",   "JIG",   "JIM",   "JO",    "JOB",   "JOE",   "JOG",
"JOT",   "JOY",   "JUG",   "JUT",   "KAY",   "KEG",   "KEN",   "KEY",
"KID",   "KIM",   "KIN",   "KIT",   "LA",    "LAB",   "LAC",   "LAD",
"LAG",   "LAM",   "LAP",   "LAW",   "LAY",   "LEA",   "LED",   "LEE",
"LEG",   "LEN",   "LEO",   "LET",   "LEW",   "LID",   "LIE",   "LIN",
"LIP",   "LIT",   "LO",   "LOB",   "LOG",   "LOP",   "LOS",   "LOT",
"LOU",   "LOW",   "LOY",   "LUG",   "LYE",   "MA",    "MAC",   "MAD",
"MAE",   "MAN",   "MAO",   "MAP",   "MAT",   "MAW",   "MAY",   "ME",
"MEG",   "MEL",   "MEN",   "MET",   "MEW",   "MID",   "MIN",   "MIT",
"MOB",   "MOD",   "MOE",   "MOO",   "MOP",   "MOS",   "MOT",   "MOW",
"MUD",   "MUG",   "MUM",   "MY",    "NAB",   "NAG",   "NAN",   "NAP",
"NAT",   "NAY",   "NE",   "NED",   "NEE",   "NET",   "NEW",   "NIB",
"NIL",   "NIP",   "NIT",   "NO",    "NOB",   "NOD",   "NON",   "NOR",
"NOT",   "NOV",   "NOW",   "NU",    "NUN",   "NUT",   "O",     "OAF",
"OAK",   "OAR",   "OAT",   "ODD",   "ODE",   "OF",    "OFF",   "OFT",
"OH",    "OIL",   "OK",   "OLD",   "ON",    "ONE",   "OR",    "ORB",
"ORE",   "ORR",   "OS",   "OTT",   "OUR",   "OUT",   "OVA",   "OW",
"OWE",   "OWL",   "OWN",   "OX",    "PA",    "PAD",   "PAL",   "PAM",
"PAN",   "PAP",   "PAR",   "PAT",   "PAW",   "PAY",   "PEA",   "PEG",
"PEN",   "PEP",   "PER",   "PET",   "PEW",   "PHI",   "PI",    "PIE",
"PIN",   "PIT",   "PLY",   "PO",    "POD",   "POE",   "POP",   "POT",
"POW",   "PRO",   "PRY",   "PUB",   "PUG",   "PUN",   "PUP",   "PUT",
"QUO",   "RAG",   "RAM",   "RAN",   "RAP",   "RAT",   "RAW",   "RAY",
"REB",   "RED",   "REP",   "RET",   "RIB",   "RID",   "RIG",   "RIM",
"RIO",   "RIP",   "ROB",   "ROD",   "ROE",   "RON",   "ROT",   "ROW",
"ROY",   "RUB",   "RUE",   "RUG",   "RUM",   "RUN",   "RYE",   "SAC",
"SAD",   "SAG",   "SAL",   "SAM",   "SAN",   "SAP",   "SAT",   "SAW",
"SAY",   "SEA",   "SEC",   "SEE",   "SEN",   "SET",   "SEW",   "SHE",
"SHY",   "SIN",   "SIP",   "SIR",   "SIS",   "SIT",   "SKI",   "SKY",
"SLY",   "SO",    "SOB",   "SOD",   "SON",   "SOP",   "SOW",   "SOY",
"SPA",   "SPY",   "SUB",   "SUD",   "SUE",   "SUM",   "SUN",   "SUP",
"TAB",   "TAD",   "TAG",   "TAN",   "TAP",   "TAR",   "TEA",   "TED",
"TEE",   "TEN",   "THE",   "THY",   "TIC",   "TIE",   "TIM",   "TIN",
"TIP",   "TO",    "TOE",   "TOG",   "TOM",   "TON",   "TOO",   "TOP",
"TOW",   "TOY",   "TRY",   "TUB",   "TUG",   "TUM",   "TUN",   "TWO",
"UN",    "UP",    "US",   "USE",   "VAN",   "VAT",   "VET",   "VIE",
"WAD",   "WAG",   "WAR",   "WAS",   "WAY",   "WE",    "WEB",   "WED",
"WEE",   "WET",   "WHO",   "WHY",   "WIN",   "WIT",   "WOK",   "WON",
"WOO",   "WOW",   "WRY",   "WU",    "YAM",   "YAP",   "YAW",   "YE",
"YEA",   "YES",   "YET",   "YOU",   "ABED",  "ABEL",  "ABET",  "ABLE",
"ABUT",  "ACHE",  "ACID",  "ACME",  "ACRE",  "ACTA",  "ACTS",  "ADAM",
"ADDS",  "ADEN",  "AFAR",  "AFRO",  "AGEE",  "AHEM",  "AHOY",  "AIDA",
"AIDE",  "AIDS",  "AIRY",  "AJAR",  "AKIN",  "ALAN",  "ALEC",  "ALGA",
"ALIA",  "ALLY",  "ALMA",  "ALOE",  "ALSO",  "ALTO",  "ALUM",  "ALVA",
"AMEN",  "AMES",  "AMID",  "AMMO",  "AMOK",  "AMOS",  "AMRA",  "ANDY",
"ANEW",  "ANNA",  "ANNE",  "ANTE",  "ANTI",  "AQUA",  "ARAB",  "ARCH",
"AREA",  "ARGO",  "ARID",  "ARMY",  "ARTS",  "ARTY",  "ASIA",  "ASKS",
"ATOM",  "AUNT",  "AURA",  "AUTO",  "AVER",  "AVID",  "AVIS",  "AVON",
"AVOW",  "AWAY",  "AWRY",  "BABE",  "BABY",  "BACH",  "BACK",  "BADE",
"BAIL",  "BAIT",  "BAKE",  "BALD",  "BALE",  "BALI",  "BALK",  "BALL",
"BALM",  "BAND",  "BANE",  "BANG",  "BANK",  "BARB",  "BARD",  "BARE",
"BARK",  "BARN",  "BARR",  "BASE",  "BASH",  "BASK",  "BASS",  "BATE",
"BATH",  "BAWD",  "BAWL",  "BEAD",  "BEAK",  "BEAM",  "BEAN",  "BEAR",
"BEAT",  "BEAU",  "BECK",  "BEEF",  "BEEN",  "BEER",  "BEET",  "BELA",
"BELL",  "BELT",  "BEND",  "BENT",  "BERG",  "BERN",  "BERT",  "BESS",
"BEST",  "BETA",  "BETH",  "BHOY",  "BIAS",  "BIDE",  "BIEN",  "BILE",
"BILK",  "BILL",  "BIND",  "BING",  "BIRD",  "BITE",  "BITS",  "BLAB",
"BLAT",  "BLED",  "BLEW",  "BLOB",  "BLOC",  "BLOT",  "BLOW",  "BLUE",
"BLUM",  "BLUR",  "BOAR",  "BOAT",  "BOCA",  "BOCK",  "BODE",  "BODY",
"BOGY",  "BOHR",  "BOIL",  "BOLD",  "BOLO",  "BOLT",  "BOMB",  "BONA",
"BOND",  "BONE",  "BONG",  "BONN",  "BONY",  "BOOK",  "BOOM",  "BOON",
"BOOT",  "BORE",  "BORG",  "BORN",  "BOSE",  "BOSS",  "BOTH",  "BOUT",
"BOWL",  "BOYD",  "BRAD",  "BRAE",  "BRAG",  "BRAN",  "BRAY",  "BRED",
"BREW",  "BRIG",  "BRIM",  "BROW",  "BUCK",  "BUDD",  "BUFF",  "BULB",
"BULK",  "BULL",  "BUNK",  "BUNT",  "BUOY",  "BURG",  "BURL",  "BURN",
"BURR",  "BURT",  "BURY",  "BUSH",  "BUSS",  "BUST",  "BUSY",  "BYTE",
"CADY",  "CAFE",  "CAGE",  "CAIN",  "CAKE",  "CALF",  "CALL",  "CALM",
"CAME",  "CANE",  "CANT",  "CARD",  "CARE",  "CARL",  "CARR",  "CART",
"CASE",  "CASH",  "CASK",  "CAST",  "CAVE",  "CEIL",  "CELL",  "CENT",
"CERN",  "CHAD",  "CHAR",  "CHAT",  "CHAW",  "CHEF",  "CHEN",  "CHEW",
"CHIC",  "CHIN",  "CHOU",  "CHOW",  "CHUB",  "CHUG",  "CHUM",  "CITE",
"CITY",  "CLAD",  "CLAM",  "CLAN",  "CLAW",  "CLAY",  "CLOD",  "CLOG",
"CLOT",  "CLUB",  "CLUE",  "COAL",  "COAT",  "COCA",  "COCK",  "COCO",
"CODA",  "CODE",  "CODY",  "COED",  "COIL",  "COIN",  "COKE",  "COLA",
"COLD",  "COLT",  "COMA",  "COMB",  "COME",  "COOK",  "COOL",  "COON",
"COOT",  "CORD",  "CORE",  "CORK",  "CORN",  "COST",  "COVE",  "COWL",
"CRAB",  "CRAG",  "CRAM",  "CRAY",  "CREW",  "CRIB",  "CROW",  "CRUD",
"CUBA",  "CUBE",  "CUFF",  "CULL",  "CULT",  "CUNY",  "CURB",  "CURD",
"CURE",  "CURL",  "CURT",  "CUTS",  "DADE",  "DALE",  "DAME",  "DANA",
"DANE",  "DANG",  "DANK",  "DARE",  "DARK",  "DARN",  "DART",  "DASH",
"DATA",  "DATE",  "DAVE",  "DAVY",  "DAWN",  "DAYS",  "DEAD",  "DEAF",
"DEAL",  "DEAN",  "DEAR",  "DEBT",  "DECK",  "DEED",  "DEEM",  "DEER",
"DEFT",  "DEFY",  "DELL",  "DENT",  "DENY",  "DESK",  "DIAL",  "DICE",
"DIED",  "DIET",  "DIME",  "DINE",  "DING",  "DINT",  "DIRE",  "DIRT",

"DISC", "DISH", "DISK", "DIVE", "DOCK", "DOES", "DOLE", "DOLL", "DOLT", "DOME", "DONE", "DOOM", "DOOR", "DORA", "DOSE", "DOTE", "DOUG", "DOUR", "DOVE", "DOWN", "DRAB", "DRAG", "DRAM", "DRAW", "DREW", "DRUB", "DRUG", "DRUM", "DUAL", "DUCK", "DUCT", "DUEL", "DUET", "DUKE", "DULL", "DUMB", "DUNE", "DUNK", "DUSK", "DUST", "DUTY", "EACH", "EARL", "EARN", "EASE", "EAST", "EASY", "EBEN", "ECHO", "EDDY", "EDEN", "EDGE", "EDGY", "EDIT", "EDNA", "EGAN", "ELAN", "ELBA", "ELLA", "ELSE", "EMIL", "EMIT", "EMMA", "ENDS", "ERIC", "EROS", "EVEN", "EVER", "EVIL", "EYED", "FACE", "FACT", "FADE", "FAIL", "FAIN", "FAIR", "FAKE", "FALL", "FAME", "FANG", "FARM", "FAST", "FATE", "FAWN", "FEAR", "FEAT", "FEED", "FEEL", "FEET", "FELL", "FELT", "FEND", "FERN", "FEST", "FEUD", "FIEF", "FIGS", "FILE", "FILL", "FILM", "FIND", "FINE", "FINK", "FIRE", "FIRM", "FISH", "FISK", "FIST", "FITS", "FIVE", "FLAG", "FLAK", "FLAM", "FLAT", "FLAW", "FLEA", "FLED", "FLEW", "FLIT", "FLOC", "FLOG", "FLOW", "FLUB", "FLUE", "FOAL", "FOAM", "FOGY", "FOIL", "FOLD", "FOLK", "FOND", "FONT", "FOOD", "FOOL", "FOOT", "FORD", "FORE", "FORK", "FORM", "FORT", "FOSS", "FOUL", "FOUR", "FOWL", "FRAU", "FRAY", "FRED", "FREE", "FRET", "FREY", "FROG", "FROM", "FUEL", "FULL", "FUME", "FUND", "FUNK", "FURY", "FUSE", "FUSS", "GAFF", "GAGE", "GAIL", "GAIN", "GAIT", "GALA", "GALE", "GALL", "GALT", "GAME", "GANG", "GARB", "GARY", "GASH", "GATE", "GAUL", "GAUR", "GAVE", "GAWK", "GEAR", "GELD", "GENE", "GENT", "GERM", "GETS", "GIBE", "GIFT", "GILD", "GILL", "GILT", "GINA", "GIRD", "GIRL", "GIST", "GIVE", "GLAD", "GLEE", "GLEN", "GLIB", "GLOB", "GLOM", "GLOW", "GLUE", "GLUM", "GLUT", "GOAD", "GOAL", "GOAT", "GOER", "GOES", "GOLD", "GOLF", "GONE", "GONG", "GOOD", "GOOF", "GORE", "GORY", "GOSH", "GOUT", "GOWN", "GRAB", "GRAD", "GRAY", "GREG", "GREW", "GREY", "GRID", "GRIM", "GRIN", "GRIT", "GROW", "GRUB", "GULF", "GULL", "GUNK", "GURU", "GUSH", "GUST", "GWEN", "GWYN", "HAAG", "HAAS", "HACK", "HAIL", "HAIR", "HALE", "HALF", "HALL", "HALO", "HALT", "HAND", "HANG", "HANK", "HANS", "HARD", "HARK", "HARM", "HART", "HASH", "HAST", "HATE", "HATH", "HAUL", "HAVE", "HAWK", "HAYS", "HEAD", "HEAL", "HEAR", "HEAT", "HEBE", "HECK", "HEED", "HEEL", "HEFT", "HELD", "HELL", "HELM", "HERB", "HERD", "HERE", "HERO", "HERS", "HESS", "HEWN", "HICK", "HIDE", "HIGH", "HIKE", "HILL", "HILT", "HIND", "HINT", "HIRE", "HISS", "HIVE", "HOBO", "HOCK", "HOFF", "HOLD", "HOLE", "HOLM", "HOLT", "HOME", "HONE", "HONK", "HOOD", "HOOF", "HOOK", "HOOT", "HORN", "HOSE", "HOST", "HOUR", "HOVE", "HOWE", "HOWL", "HOYT", "HUCK", "HUED", "HUFF", "HUGE", "HUGH", "HUGO", "HULK", "HULL", "HUNK", "HUNT", "HURD", "HURL", "HURT", "HUSH", "HYDE", "HYMN", "IBIS", "ICON", "IDEA", "IDLE", "IFFY", "INCA", "INCH", "INTO", "IONS", "IOTA", "IOWA", "IRIS", "IRMA", "IRON", "ISLE", "ITCH", "ITEM", "IVAN", "JACK", "JADE", "JAIL", "JAKE", "JANE", "JAVA", "JEAN", "JEFF", "JERK", "JESS", "JEST", "JIBE", "JILL", "JILT", "JIVE", "JOAN", "JOBS", "JOCK", "JOEL", "JOEY", "JOHN", "JOIN", "JOKE", "JOLT", "JOVE", "JUDD", "JUDE", "JUDO", "JUDY", "JUJU", "JUKE", "JULY", "JUNE", "JUNK", "JUNO", "JURY", "JUST", "JUTE", "KAHN", "KALE", "KANE", "KANT", "KARL", "KATE", "KEEL", "KEEN", "KENO", "KENT", "KERN", "KERR", "KEYS", "KICK", "KILL", "KIND", "KING", "KIRK", "KISS", "KITE", "KLAN", "KNEE", "KNEW", "KNIT", "KNOB", "KNOT", "KNOW", "KOCH", "KONG", "KUDO", "KURD", "KURT", "KYLE", "LACE", "LACK", "LACY", "LADY", "LAID", "LAIN", "LAIR", "LAKE", "LAMB", "LAME", "LAND", "LANE", "LANG", "LARD", "LARK", "LASS", "LAST", "LATE", "LAUD", "LAVA", "LAWN", "LAWS", "LAYS", "LEAD", "LEAF", "LEAK", "LEAN", "LEAR", "LEEK", "LEER", "LEFT", "LEND", "LENS", "LENT", "LEON", "LESK", "LESS", "LEST", "LETS", "LIAR", "LICE", "LICK", "LIED", "LIEN", "LIES", "LIEU", "LIFE", "LIFT", "LIKE", "LILA", "LILT", "LILY", "LIMA", "LIMB", "LIME", "LIND", "LINE", "LINK", "LINT", "LION", "LISA", "LIST", "LIVE", "LOAD", "LOAF", "LOAM", "LOAN", "LOCK", "LOFT", "LOGE", "LOIS", "LOLA", "LONE", "LONG", "LOOK", "LOON", "LOOT", "LORD", "LORE", "LOSE", "LOSS", "LOST", "LOUD", "LOVE", "LOWE", "LUCK", "LUCY", "LUGE", "LUKE", "LULU", "LUND", "LUNG", "LURA", "LURE", "LURK", "LUSH", "LUST", "LYLE", "LYNN", "LYON", "LYRA", "MACE", "MADE", "MAGI", "MAID", "MAIL", "MAIN", "MAKE", "MALE", "MALI", "MALL", "MALT", "MANA", "MANN", "MANY", "MARC", "MARE", "MARK", "MARS", "MART", "MARY", "MASH", "MASK", "MASS", "MAST", "MATE", "MATH", "MAUL", "MAYO", "MEAD", "MEAL", "MEAN", "MEAT", "MEEK", "MEET", "MELD", "MELT", "MEMO", "MEND", "MENU", "MERT", "MESH", "MESS", "MICE", "MIKE", "MILD", "MILE", "MILK", "MILL", "MILT", "MIMI", "MIND", "MINE", "MINI", "MINK", "MINT", "MIRE", "MISS", "MIST", "MITE", "MITT", "MOAN", "MOAT", "MOCK", "MODE", "MOLD", "MOLE", "MOLL", "MOLT", "MONA", "MONK", "MONT", "MOOD", "MOON", "MOOR", "MOOT", "MORE", "MORN", "MORT", "MOSS", "MOST", "MOTH", "MOVE", "MUCH", "MUCK", "MUDD", "MUFF", "MULE", "MULL", "MURK", "MUSH", "MUST", "MUTE", "MUTT", "MYRA", "MYTH", "NAGY", "NAIL", "NAIR", "NAME", "NARY", "NASH", "NAVE", "NAVY", "NEAL", "NEAR", "NEAT", "NECK", "NEED", "NEIL", "NELL", "NEON", "NERO", "NESS", "NEST", "NEWS", "NEWT", "NIBS", "NICE", "NICK", "NILE", "NINA", "NINE", "NOAH", "NODE", "NOEL", "NOLL", "NONE", "NOOK", "NOON", "NORM", "NOSE", "NOTE", "NOUN", "NOVA", "NUDE", "NULL", "NUMB", "OATH", "OBEY", "OBOE", "ODIN", "OHIO", "OILY", "OINT", "OKAY", "OLAF", "OLDY", "OLGA", "OLIN", "OMAN", "OMEN", "OMIT", "ONCE", "ONES", "ONLY", "ONTO", "ONUS", "ORAL", "ORGY", "OSLO", "OTIS", "OTTO", "OUCH", "OUST", "OUTS", "OVAL", "OVEN", "OVER", "OWLY", "OWNS", "QUAD", "QUIT", "QUOD", "RACE", "RACK", "RACY", "RAFT", "RAGE", "RAID", "RAIL", "RAIN", "RAKE", "RANK", "RANT", "RARE", "RASH", "RATE", "RAVE", "RAYS", "READ", "REAL", "REAM", "REAR", "RECK", "REED", "REEF", "REEK", "REEL", "REID", "REIN", "RENA", "REND", "RENT", "REST", "RICE", "RICH", "RICK", "RIDE", "RIFT", "RILL", "RIME", "RING", "RINK", "RISE", "RISK", "RITE", "ROAD", "ROAM", "ROAR", "ROBE", "ROCK", "RODE", "ROIL", "ROLL", "ROME", "ROOD", "ROOF", "ROOK", "ROOM", "ROOT", "ROSA", "ROSE", "ROSS", "ROSY", "ROTH", "ROUT", "ROVE", "ROWE", "ROWS", "RUBE", "RUBY", "RUDE", "RUDY", "RUIN", "RULE", "RUNG", "RUNS", "RUNT", "RUSE", "RUSH", "RUSK", "RUSS", "RUST", "RUTH", "SACK", "SAFE", "SAGE", "SAID", "SAIL", "SALE", "SALK", "SALT", "SAME", "SAND", "SANE", "SANG", "SANK", "SARA", "SAUL", "SAVE", "SAYS", "SCAN", "SCAR", "SCAT", "SCOT", "SEAL", "SEAM", "SEAR", "SEAT", "SEED", "SEEK", "SEEM", "SEEN", "SEES", "SELF", "SELL", "SEND", "SENT", "SETS", "SEWN", "SHAG", "SHAM", "SHAW", "SHAY", "SHED", "SHIM", "SHIN", "SHOD", "SHOE", "SHOT", "SHOW", "SHUN", "SHUT", "SICK", "SIDE", "SIFT", "SIGH", "SIGN", "SILK", "SILL", "SILO", "SILT", "SINE", "SING", "SINK", "SIRE", "SITE", "SITS", "SITU", "SKAT", "SKEW", "SKID", "SKIM", "SKIN", "SKIT", "SLAB", "SLAM", "SLAT", "SLAY", "SLED", "SLEW", "SLID", "SLIM", "SLIT", "SLOB", "SLOG", "SLOT", "SLOW", "SLUG", "SLUM", "SLUR", "SMOG", "SMUG", "SNAG", "SNOB", "SNOW", "SNUB", "SNUG", "SOAK", "SOAR", "SOCK", "SODA", "SOFA", "SOFT", "SOIL", "SOLD", "SOME", "SONG", "SOON", "SOOT", "SORE", "SORT", "SOUL", "SOUR", "SOWN", "STAB", "STAG", "STAN", "STAR", "STAY", "STEM", "STEW", "STIR", "STOW", "STUB", "STUN", "SUCH", "SUDS", "SUIT", "SULK", "SUMS", "SUNG", "SUNK", "SURE", "SURF", "SWAB", "SWAG", "SWAM", "SWAN", "SWAT", "SWAY", "SWIM", "SWUM", "TACK", "TACT", "TAIL", "TAKE", "TALE", "TALK", "TALL", "TANK", "TASK", "TATE", "TAUT", "TEAL", "TEAM", "TEAR", "TECH", "TEEM", "TEEN", "TEET", "TELL", "TEND", "TENT", "TERM", "TERN", "TESS", "TEST", "THAN", "THAT", "THEE", "THEM", "THEN", "THEY", "THIN", "THIS", "THUD", "THUG", "TICK", "TIDE", "TIDY", "TIED", "TIER", "TILE", "TILL", "TILT", "TIME", "TINA", "TINE", "TINT", "TINY", "TIRE", "TOAD", "TOGO", "TOIL", "TOLD", "TOLL", "TONE", "TONG", "TONY", "TOOK", "TOOL", "TOOT", "TORE", "TORN", "TOTE", "TOUR", "TOUT", "TOWN", "TRAG", "TRAM", "TRAY", "TREE", "TREK", "TRIG", "TRIM", "TRIO", "TROD", "TROT", "TROY", "TRUE", "TUBA", "TUBE", "TUCK", "TUFT", "TUNA", "TUNE", "TUNG", "TURF", "TURN", "TUSK", "TWIG", "TWIN", "TWIT", "ULAN", "UNIT", "URGE", "USED", "USER", "USES", "UTAH", "VAIL", "VAIN", "VALE", "VARY", "VASE", "VAST", "VEAL", "VEDA", "VEIL", "VEIN", "VEND", "VENT", "VERB", "VERY", "VETO", "VICE", "VIEW", "VINE", "VISE", "VOID", "VOLT", "VOTE", "WACK", "WADE", "WAGE", "WAIL", "WAIT", "WAKE", "WALE", "WALK", "WALL", "WALT", "WAND", "WANE", "WANG", "WANT", "WARD", "WARM", "WARN", "WART", "WASH", "WAST", "WATS", "WATT", "WAVE", "WAVY", "WAYS", "WEAK", "WEAL", "WEAN", "WEAR", "WEED", "WEEK", "WEIR", "WELD", "WELL", "WELT", "WENT", "WERE", "WERT", "WEST", "WHAM", "WHAT", "WHEE", "WHEN", "WHET", "WHOA", "WHOM", "WICK", "WIFE", "WILD", "WILL", "WIND", "WINE", "WING", "WINK", "WINO", "WIRE", "WISE", "WISH", "WITH", "WOLF", "WONT", "WOOD", "WOOL", "WORD", "WORE", "WORK", "WORM", "WORN", "WOVE", "WRIT", "WYNN", "YALE", "YANG", "YANK", "YARD", "YARN", "YAWL", "YAWN", "YEAH", "YEAR", "YELL", "YOGA", "YOKE" };

Okay bestie, the legal bit is next, and this one has to stay word-for-word because the RFC itself says nobody's allowed to edit it 🫶

Copyright (C) The Internet Society (1998). All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

📦 where this page comes from