The OpenPGP (private) key format stores the key symmetrically encrypted. The "iterated and salted" setup derives this key from a passphrase, taking a "octet count" parameter that determines the complexity of expanding the passphrase into a symmetric key. With the highest value for this parameter (~65 million), key expansion takes about a second on my computer (GPG).

With this kind of setup, is it possible to make it hard enough to brute-force that it's sane to have the private-key publicly available?

I expect the answer depends on the passphrase complexity. E.g. if you somehow managed to have a passphrase with 256 bits of entropy, then an attacker would be better off just guessing the derived key instead of the passphrase - which in this case amounts to brute-forcing an AES key (which I'd consider hard enough to be "safe"). So the question might really be "how complex does your passphrase have to be to make this safe?".

  • 2
    I don't have a solid answer to give you, but just wanted to comment that you seem fairly correct. You do risk making yourself a juicy target if you choose to taunt hackers with the encrypted key. Your threat model will likely change significantly by issuing such a challenge. Jan 14, 2015 at 2:22
  • This question can't really be answered without considering the value of the data being protected. How much incentive is there for the attacker to up his capability and crack your pw?
    – pboin
    Jan 14, 2015 at 14:07
  • Interesting point - presumably that's the tradeoff you make with passphrase complexity, where a 256-bit passphrase should be safe for most things, but a 30-bit one might fall victim to a pissed-off GamerGater or somesuch?
    – cloudfeet
    Jan 14, 2015 at 15:49
  • why would you want to store it publicly? or is this just a theoretical question?
    – tim
    Jan 14, 2015 at 19:21
  • I was looking at situations where although the application may be stored locally, no other local data storage is allowed (e.g. saved HTML file). In this kind of situation, you'd need to store all the personalised data in "public" (at the very least the server can inspect it, possibly everyone).
    – cloudfeet
    Jan 15, 2015 at 17:54

1 Answer 1


You've already answered your own question. The question becomes, how many resources can the attacker put on cracking your password, and how good are people at choosing passwords?

The largest supercomputer currently has around 3 million cores. Let's assume each core has about the same amount of processing power as your workstation. That's 3 million cracks/second.

In a year, such a machine could crank through about 47 bits of entropy. In 10 years, that number only goes up to 50 bits of entropy. With 64 bits of entropy, the cracking time goes up to a million years. Of course, computers get faster, so if we assume a doubling time of 1.5 years, you can remove 2 bits of entropy every 3 years. So in 10 years, 53 bit keys will be crackable in a year. In 20, 60 bit keys. So that sounds really great, right? 64 bits of entropy is pretty easy if people use the the simple xkbcd comic http://xkcd.com/936/

Now... the reality is that most people WON'T pick good passwords, and don't understand entropy. They'll still pick "password123", their dogs name, or their phone number. They don't understand offline attacks. Those are all low entropy sources, and could be cracked by a single individual very easily even with a garden variety PC.

So what can you, yourself crack, with just your piddly little PC at 1/second? In just a day you can go through 86,000 tries, or all the words in the a largish dictionary. In a month, you can try 2.6 million.

So I'd say if you're talking about posting private keys encrypted for anyone to just download, you'd be asking for trouble. Some other means of protecting these keys would be more appropriate.

  • Hmm, good answer but that comic is totally bogus. A single random (not necessarily) common word from the dictionary has about 3 random characters worth of entropy. Given that the comic states 'common' words, its very likely that both passwords have approximately the same entropy. Jan 21, 2015 at 13:12
  • If you use case-insensitive alphabetic characters only, then "3 random characters" is about 14 bits (log2(26*26*26)), which roughly matches up with the 44-bit conclusion for the four random words - this would be equivalent to a 12-character random password. The comic's point is that the characters in the Tr0ub4dor&3 password are not randomly picked, but instead generated from a single word with some fairly trivial modifications, so is much more predictable than random letters.
    – cloudfeet
    Jan 21, 2015 at 13:34
  • 1
    The xkcd comic has the math right. There's a well thought out answer elsewhere that's pretty easy to find here. To me the comic nicely illustrates the concept of entropy in a password. I'd have my doubts that people will pick "random" words though if they choose this method. If you ask people to pick a number between 1 and 10, there's a few choices people typically pick over other choices because they "feel" more random. It wouldn't surprise me if people did the same thing with words. Jan 21, 2015 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .