How long "digits-only recovery code" is secure enough?

Question

I'm implementing encryption in one of my webextension which will encrypt locally stored data.
I have a single master CryptoKey (AES-GCM) that encrypts everything.
And this master key is then encrypted (using crypto.subtle.wrapKey) with:

1. user password
2. randomly generated "recovery code"

Both are hashed using PBKDF2 with 1e6 iterations of SHA-256 and 128 bit salt.

I want the recovery key to be numbers only, so how long should it be to be secure enough against local attacks?
(let's say someone copies the data to USB drive and hacks it at home).

For example BitLocker is using 48 digits long number. Is that good enough? I guess the complexity of hashing algorithm is highly correlating with required length and I don't know what BitLocker is using.

Answer 1

No one can really say if it's "good enough", because that will always depend on your threat model. Protecting against a curious person who finds a lost USB stick is very different from trying to keep data safe from a nation state for the next hundred years.

Having said that, 48 numeric digits is ~160 bits, which (assuming that they are securely random) is well beyond the limits of any brute-force attacks, and is likely to stay that way.

77 digits would give you ~256 bits of security, and there's not much point going higher than that if you're storing the output as a 256 bit hash.

But it's worth bearing in mind that in both cases, the user's password is likely to be much weaker than that.