Is there any good way of calculating a brain-generated password's entropy?

Question

After reading this post, I understand that a password's entropy depends on the assumptions made when it is to be attacked (e.g. if it is generated randomly from a list of 2048 words, etc.).

Let's suppose an attacker managed to enter some users' cloud storage and found some symmetrically encrypted files. Which assumptions, to attack the password by brute force, would be reasonable for the attacker to make? For instance, since it is a symmetric encryption, a reasonable assumption is that the password has been brain-generated. I imagine this fact generates a subsequent set of assumptions about the password.

Knowing these assumptions, is there any way of calculating the actual entropy of a brain-generated password?

Answer 1

Trying to calculate a numeric value for the entropy of a password only makes sense if you understand the actual mechanism that is used to generate it. For example, it's relatively easy to work out the entropy for a password that's created from 3 random words out a list of 20,000, or that's created by choosing 8 random alphanumeric characters.

But you can't really work out a number based on "brain generated", because that covers a huge variety of different possible approaches. And even if you know the approach they use (such as picking a random word, and then sticking a digit on the end), humans can't do "random".

There also an unknown factor that people create passwords differently in different contexts. Most people will try and create (what they think is) a more secure password for their online banking than for some random forum they don't care about. So it's not enough to know how an individual creates passwords; you need to know how they created this password.

You could potentially try and calculate some kind of number based on how hard is was for you to crack that password - but that number would depends largely on how you were trying to crack it, so will be very variable.

TBH, any kind numeric value for the strength of a password should be taken with a big pinch of salt, and even more so if it's not a password that was computer generated.

So I think you'll struggle to calculate any kind of meaningful value - which leads to the question of what you're trying to achieve by doing so?

Answer 2

This answer pertains to this question, and the similar question at https://security.stackexchange.com/questions/270052/how-unsecure-actually-is-to-store-crypto-currency-seeds-in-cloud-provided-that.

Instead of creating a random bitcoin private key, then using a password to derive and AES256 key, then using the AES256 key to encrypt your bitcoin private key, then storing the encrypted bitcoin private key on someone else's server - you might want to consider using a brain wallet to derive a bitcoin private key directly from a password (or passphrase). This eliminates the need store anything.

AES256 keys and bitcoin private keys are both 256 bits in length. So the same key derivation functions (KDFs) that are used to derive AES256 keys from passwords can be used to derive a bitcoin key directly from a password (or passphrase). So, if you are concerned about a brain wallet program that you are using noe becoming deprecated in the future, you can simply use a standard key derivation function (such as PBKDF2, Bcrypt, Argon2, etc.) to derive a bitcoin private key from a passphrase. If you want to store the bitcoin private key as a backup (in case you forget the passphrase), you can.

IMPORTANT: If you decide to go this route, be sure to use a strong KDF (such as Argon2 with a very high cost factor), and be sure to use a strong high-entropy passphrase. Once your bitcoin address has coins associated with it, there will be actors with lots of computing power trying to crack your key, so both of the above are critical to slowdown such attacks.