Expert quote on entropy for uncrackable password

Question

Could anyone point to a quote in a published work - or suggest a recognised expert who might provide a quote - which answers the following question

How much entropy in a password would guarantee that it is secure against an offline guessing attack even if the attacker has the most powerful hardware in the world?

I am writing an article about creating a secure password based on true randomness and I would like to include a figure for guaranteed security but I would rather not offer my own opinions and arguments, I would like to quote a recognised expert or published work.

In more detail what is meant above by these terms is as follows.

If a password has enough entropy then presumably it is uncrackable in our current threat model, which is the one where the attacker has a cryptographic hash of the password and is repeatedly making a password guess, hashing the guess and comparing the hash.

By entropy I mean that the password creator has chosen randomly, with equal probability for each choice, a password from N possible passwords. The entropy in bits is then log₂(N)

So quote needs to cover how much entropy in bits (or how big is N) to guarantee that the password is secure against this kind of attack, even if the attacker has the most powerful hardware in the world.

Answer 1

Let's take a different crack from a monetary perspective instead of a physics perspective. Skylar Nagao at Peerio stated that:

In a 2014 research paper on password memorability, security researchers Joseph Bonneau (Stanford) and Stuart Schechter (Microsoft) estimated the cost of an attack based on the total annual payout to bitcoin miners in 2013.

"In 2013, Bitcoin miners collectively performed ≈ 2⁷⁵ SHA-256 hashes in exchange for bitcoin rewards worth ≈ US$257M… this is the only publicly known operation performing in excess of 2⁶⁴ cryptographic operations and hence provides the best estimate available. Even assuming a centralized effort could be an order of magnitude more efficient, this still leaves us with an estimate of US$1M to perform a 2⁷⁰ SHA-256 evaluations and around US$1B for 2⁸⁰ evaluations."

Here we have the billion dollar password estimate — even for a centralized state attacker, it would cost about $1 billion US dollars to compute 2⁸⁰ SHA-256 hash functions over the course of a year. This is like saying it would cost $1 billion USD to try 2⁸⁰ lock combinations over a year. Since an attacker would be ‘likely’ to guess correctly with just one guess after the halfway point, Peerio uses an 81-bit (2⁸⁰ times two) minimum standard for our computer generated passphrases. We chose this standard because we wanted to make sure even a state level attacker would need to drop $1 billion US dollars to have even a coin’s toss chance of cracking a Peerio passphrase.

An 81-bit password is estimated to cost 1 billion to be likely to crack and so is considered by Peerio to be "uncrackable". In layman's terms 81-bits would work out to 17 random lower-case letters, 13 random characters from a US keyboard, or 7-8 words randomly chosen from a dictionary.

There are admittedly a lot of technical details like prices, risk levels, and hashing algorithms. Perhaps the passwords are hashed much, much more strongly with bcrypt. Perhaps these figures are out of date and more modern mining costs or the latest mining revenue data puts the hashes/dollar as high as 10¹⁶ hashes/dollar. Maybe Bitcoin isn't the best comparison due to market differences or hardware differences. At the end of the day we still have an order of magnitude for the lowest cost of hashing at scale.

Even if some nation-state or millionaire put together a hash-breaking farm the size of Bitmain's Ordos mine, they'd still take months to have a good chance of finding your 80-bit password password from an insecure hash, and throw away millions or even billions of dollars of cost and lost potential revenue. If any government could hit a billion terahashes per second, I bet they have better things to do with that money-making machine than crack your 81-bit password.

If we're talking about guarantees and defense against incredibly powerful adversaries, it's important to note that there are plenty of ways to get around an uncrackable password. Methods include session hijacking, MITM attacks, password reset exploits, keyloggers, asking the website/admin for access, and phishing. Although some threats like physically tampering with your computer may seem absurd, they're more reasonable than a billion dollar password cracking effort (relevant xkcd).

Answer 2

There's a quote for you in this crypto.SE answer, by Bruce Schneier in Applied Cryptography (1996), pp. 157–8.

You can also find Bruce Schneier citing himself in his blog (2009), if you want an online citation.

Here is the full quote, in case of the links breaking:

One of the consequences of the second law of thermodynamics is that a certain amount of energy is necessary to represent information. To record a single bit by changing the state of a system requires an amount of energy no less than kT, where T is the absolute temperature of the system and k is the Boltzman constant. (Stick with me; the physics lesson is almost over.)

Given that k = 1.38×10^-16erg/°Kelvin, and that the ambient temperature of the universe is 3.2°Kelvin, an ideal computer running at 3.2°K would consume 4.4×10^-16 ergs every time it set or cleared a bit. To run a computer any colder than the cosmic background radiation would require extra energy to run a heat pump.

Now, the annual energy output of our sun is about 1.21×10⁴¹ ergs. This is enough to power about 2.7×10⁵⁶ single bit changes on our ideal computer; enough state changes to put a 187-bit counter through all its values. If we built a Dyson sphere around the sun and captured all of its energy for 32 years, without any loss, we could power a computer to count up to 2¹⁹². Of course, it wouldn’t have the energy left over to perform any useful calculations with this counter.

But that’s just one star, and a measly one at that. A typical supernova releases something like 10⁵¹ ergs. (About a hundred times as much energy would be released in the form of neutrinos, but let them go for now.) If all of this energy could be channeled into a single orgy of computation, a 219-bit counter could be cycled through all of its states.

These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.

Update: If you want a citation to assess the strength of a randomly generated password, you can use this website that is regularly updated with recommendations made by different institutes. A random password is equivalent to a symmetric key, so this is the value you are looking for. (Here is a wayback machine link, if this website were to close.)

Answer 3

UPDATE:

A really good YouTube video exploring this topic is:

How secure is 256 bit security? by 3Blue1Brown

---

I don't have a quote or original source, but I often answer questions like this with an energy reduction. The argument goes like this: assume humanity can one day make processors at some physics limit of efficiency. Then compute the amount of electricity it would take those processors to crack the password, then compute the number of stars the size of the sun you would need to consume to produce that much electricity. Short version: to crack one of the 32-char random passwords from a password manager, you're looking at consuming like 2x10¹⁵ stars in electricity costs alone. For example, see my recent answers here:

Should I vary the length of my completely-random passwords for the best security?

and here

Why brute-force the password instead of the key directly?

I'm actually not sure where I originally got the idea, but it might give you a starting point for googling to find a quotable source.

---

Remember also than when talking about "passwords" in the general public, you need to be very careful to frame it as "properly random passwords from a password manager". If you allow users to choose their own passwords then the length is more or less irrelevant because humans choose stupidly predictable passwords, for example, this article:

How to Break 30 Per Cent of Passwords in Seconds

Answer 4

I'm in agreement with what others have written. As an additional piece of information, see this recent (relative) talk on Argon2. One page (slide #8) gives a relative recent quote on effects of advances in hardware on practical strength of passwords under brute-force attacks. Namely

Brute-force attacks (such as key guessing) are most efficient on custom hardware: multiple computing cores on large ASICs. Practical example of SHA-2 hashing (Bitcoin):

• 232 hashes/joule on ASIC;
• 217 hashes/joule on laptop.

Consequences:

• Keys lose 15 bits
• Passwords become 3 lowercase letters shorter
• PINs lose 5 digits

ASIC-equipped attackers are the threat from the near future. ASICs have high entry costs, but FPGA and GPU are employed too.

Hopefully this gives you a practical, updated perspective on the 'effective' length of key sizes under brute-force attacks using modern hardware.