Is an 80 bit password good enough for all practical purposes?

Question

I know that asking how many bits of entropy comprise a strong password is rather like asking the length of a piece of string. But assuming the NSA is not on to you, and that it is hardly worthwhile anyone spending a decade brute forcing your email, then will 80 bits suffice?

Answer 1

Short answer: The more the better, but for now (2014) this is probably enough.

There is an important distinction between hacking into your Gmail and cracking an offline password. If you want to hack a Gmail account by guessing the password, you can only do a few tries per second at most. Google will block thousands of login attempts to a single account in too short a timeframe.

However if we are talking about, say, a Windows login, then it is stored locally. Windows has a database with the hashed password somewhere on the hard drive (in layman's terms: the encrypted password). This means that someone with access to the hard drive can extract the hashed password and start cracking however fast their computer can, which may be many millions of attempts per second.

Or when a database is hacked (see: LinkedIn), hashed password are often obtained and people can start cracking locally just like with a Windows login. This is where password strength really becomes important.

Edit: Like emory and JS. commented, you should assume all services get hacked at some point, so while right now you may not be able to brute force your Gmail password very fast, it could change any day. And not every company admits (or knows) that they got hacked. I still think it's okay to use reasonable passwords (if hackers can't crack it in 5 minutes they are just going to move on to one of the other 90 million passwords they obtained), but it's a valid point that no service is perfectly secure.

---

About password strength

(Jargon: you can think of "entropy" as being "true random data".)

So is 80 bits enough? Consider the following 80-bits password: 1111111111. Doesn't look very strong... How about this one, which is 160 bits: "horse battery staple" (20 bytes times 8). Better, but it's actually 3 words instead of 160 bits. If there are 10'000 possibilities in the English language then you can make 1 trillion combinations with 3 words, which is a lot, but nowhere near the 1 quindecillion possibilities you would have with 160 bits of entropy. Finally, how about 0MxLrTm8Z1? That is generated by a secure random number generator. It's 10 characters and takes 80 bits in storage. But how much entropy does it really contain? It's only alphanumeric (a-z A-Z 0-9), or 62 possibilities, making only 8.39*10^17 possibilities, or 59.5 bits of entropy.

So having a 10-character password does not mean you have 80 bits of entropy to crack through before finding the original. To store 80 bits in printable characters (the ones that you can type on a keyboard), which includes special characters like *&$@, you would need a password of 13 characters long.

Forward thinking

Another issue is that computers get ever faster. 80 bits is secure for now, but if you encrypt a file in 2014 with a now-safe password, maybe it could be cracked in 2017 when 36 months* have passed and computers became roughly 4 times faster.

While in 1993 a 6-character password (taken straight from a dictionary) might be reasonable security, in 2014 we debate whether 10 random characters is enough.

* Attentive readers will notice that's twice Moore's law (even more attentive readers will note that Moore's law was about transistors on a chip, not a computer's speed).

Password usage

And finally we have practical matters to think of: how do you manage your passwords? If I tell you that 80 bits is probably enough (which I just did), are you going to memorize a random 13-character password with lots of strange characters, and then use it for every account you have?

Whether a password manager is a good idea is another topic, but using different passwords is better than remembering a strong master password. It would be best to use a strong and unique password everywhere, but that's just not doable without writing it down or using a password manager, which introduces other risks. I'll leave such considerations to a dedicated question.

Answer 2

The weak point in any security strategy is always human predictability. Any clever password that you can think of, and remember, will be remarkably similar to a lot of other clever passwords people use. We just aren't as unique as we believe ourselves to be. People essentially think and memorise things in well understood and predictable ways.

Some basic principles I use in regard to passwords.

1. Use a password manager. Our brains simply are not equipped to store multiple secure passwords. If you can memorise your passwords, then they are too simple.
2. Never use the same password for more than one service. This is extraordinarily important, but almost always ignored. This principal is easy with a password manager, and virtually impossible without.
3. Your identity is only as secure as your weakest password. However unimportant or mundane you may believe your email, or social media account to be, it still needs to be secure, as it can often be used to gain access to your more confidential services.
4. If you can avoid it, don't use password hints. If a service mandates it, use something random and not personally identifiable. Having said that, only do this if you have a robust password management strategy in place. You should never have to use password recovery, because you should never lose your passwords.
5. Use the maximum possible password length. Again, this necessitates the use of a password manager. Most services now support at least 16 characters. Use them all.
6. Lock and encrypt all of your mobile devices. Your personal information (no matter how mundane) is valuable to cyber criminals.

Answer 3

It has been stated (for a reasonably authoritative source, see Passphrases That You Can Memorize — But That Even the NSA Can’t Guess on The Intercept) that the NSA is capable of (at least) "one trillion guesses per second" in the context of PGP passphrases. PGP passphrases are deliberately expensive to check, and they may have upgraded their capabilities since, but we can still use this as some sort of baseline, because it's unlikely the be more than a few orders of magnitude off with any reasonably designed system.

One trillion guesses per second corresponds to 2⁴⁰ guesses per second.

A password with a true 80 bits of entropy would thus be secure for up to 2^(80-40) = 2⁴⁰ seconds.

2⁴⁰ seconds is about 35,000 years.

On average, we'd expect an adversary to guess the password correctly in half that time. That's still well over 15,000 years of trying.

Even figuring in advancements in computer technology, and assuming that you only need your password to be secure for several thousand years, we can thus reasonably state that an 80 bits entropy password should be sufficient against even a focused offline attack by a highly capable adversary for hundreds to thousands of years.

Chances are pretty good that they'll tire of waiting well before that long, and try some other, far more likely to be successful, method instead.

Do also keep in mind the difference between true entropy and the amount of storage needed to save the password bytes. For example, my password manager (KeePassX on Linux) insists that the password's number of "bits" is equal to the number of characters in the password times eight. This leads to such absurdities as a four-digit PIN for a bank card being claimed to have 32 bits of strength (4.3 billion possible values) instead of the much more accurate value 13-14 bits of strength (because 13 bits allows encoding 8192 possible values, and you need about 13.3 bits to encode 10000 values).

One way to get to 80 bits of true entropy is to generate a 6 or 7 (at 12.9 bits each, that's 77 and 90 bits respectively) word passphrase using the Diceware method. By using one of the EFF wordlists (the one which is unique in the first three characters of each word), this can be represented in 18 or 21 characters; this compares quite favorably to a truly random, single-case alphanumeric password (lowercase a-z, digits 0-9), which would need 17 characters to encode 80 bits of entropy (because log₂ 26¹⁷ ≈ 80, or 26¹⁷ ≈ 2⁸⁰), and may be easier to remember as it would be possible to memorize the words and type just the first three letters of each.

Answer 4

Yes, in particular in the light of "practical purposes" for the non-NSA type of attacker.

For online passwords, the rate at which attacks on the password can be done is limited. Also, there usually exist security exploits (customer service being the single biggest security exploit by design) which are often much more vulnerable than your password. Why waste hundred thousands of dollars cracking your 80-bit password if you can get CS to grant you access with a few minutes of social engineering.
Yes, someone stealing the password database on a server might reverse your password with brute-force, but that's unlikely to happen with 80 bits, they'll rather do the 10 million other users who have 20-bit passwords, and stop there. Also, you have nothing to lose since it's a random password which isn't used elsewhere. It is worthless.
The intruders already have root access to the server at that point, so whatever they can do on the compromised system, they'll do it anyway. Beyond that, there's nothing they can do with your password.

For the Windows password, 80 bits are also by far good enough. Sure, someone could run a brute-force attack, but as lame as NTLM is, even the famous 25-GPU 348-billion-NTLM-per-second machine would take 110.000 years for an exhaustive search.
On the other hand, you can just plug the harddisk into another computer and read the filesystem anyway, without knowing the password. It takes like 5 seconds, and you don't even need to open your case if you have a SATA-USB adapter. What will an attacker likely do?

For full-disk encryption, on the other hand, the key (or password) isn't normally stored, but a complicated key derivation scheme is used to derive the decryption key for the decryption key table. This limits the rate at which an attack can happen. Truecrypt used to use 2,000 iterations once upon a time, Veracrypt presently uses 320,000 or so iterations. It is a reasonable assumption that all full-disk encryption systems use a number of iterations (though some will use more, some fewer - I'd assume Bitlocker is rather at the lower end).
The fact that you need to read and decrypt at least 2 sectors (after doing a few thousand iterations) in order to verify whether a password matches further delays massively parallel attacks. A random 80-bit password is thus a quite non-neglegible hurdle for the average non-NSA attacker.

Would a 256-bit password give you more security? Sure, but you also have to hit three times as many keys every time. Which is where the "practical" part comes into the equation from the other angle. It doesn't just matter whether it's practical for someone to attack you, but also whether the system remains practical for you to use every day.

Answer 5

I think so, but its important to understand true entropy when it comes to how computers brute force.

A word in the dictionary in any language can be thought of as a character, similar to a chinese character. And there are common words and uncommon words. Uncommon words can be thought of as having a very large alphabet, common words having a much smaller alphabet, but still much larger than the english set.

All of that being said, password entropy calculators don't take this into the equation, they treat a string-digit password as if it were a random password, which isn't the case.

A string-digit password: "el1zabeth267" A computer will guess this as basically two characters, not twelve.

Answer 6

EFF publishes a table of 7776 (6^6) words with the special property that no word is a prefix of another. Download it, then get a single die (dice) that you trust is not biased and roll it six times. Write down the numbers from each roll in the order they appear (e.g. "123456"), and use that as a key to look up a word and write it down.

Do that again 6 times. That's your new passphrase that you can use to protect your master password database or your email account.

Remembering six random words shouldn't be much harder than memorizing a one or two verses from a song. You could even put the words to music if it helps!

Each word comes with about 12.9 bits of entropy (log2(7776)). Six words gives you just a bit under the 80 bits of entropy discussed here. Seven words puts you over 90 bits.

Write down the words, carry them with you in your wallet (so you'll know immediately if it goes missing) and begin using them to log into your master password database or email account. In a few days, you should no longer need to keep them written down and you can shred the piece of paper (or lock it up somewhere secure if your afraid you might forget later).

OR, you can download and install Diceware do the grunt work for you and generate (pseudo-)random pass-phrases instantly. It's a lot easier than rolling dice and looking up words in a long table. The sequences won't be truly random, like actual dice, but unless your attacker has access to your computer and knows exactly what the time was on your clock when you generated them, they should be just as good.