I've read various articles on password strength and passwords vs pass phrases (including the one from XKCD and its thread here), but most of those articles seem to be focused on online passwords, and make claims like passwords only needing to be safe for 70 days (until you change them) and usually assume some form of limitation, like network latencies, etc.
My question is, what is a reasonable estimate for password-guesses per second for disk ecnryption systems (like Truecrypt)? The only true limitation here is the number of CPUs available to the attacker (since cracking attempts can be easily parallelized).
Even something as high as 10^12 guesses/second seems like a low estimate, when considering that at 1 guesses/clock-tick, with 1GHz-CPUs, that only means 1000 CPUs working in parallel.
How much do the key-derivation schemes built into disk encryption software (like Truecrypt's application of SHA/Whirlpool) really help here? By how much can they realistically lower the guesses/clock-tick factor?
The problem with XKCD's scheme, I'm afraid, is that in order to get some 30ish years (I guess that's a reasonable estimate for the statute of limitations, for most legal matters, in most countries) of security out of it, you'll need 7 words .. and remembering all of them in the correct order isn't really that much easier than some 16-character obscure combination