This is a tale of the intersection between thermal physics, cosmology, and a tiny amount of computer science to answer a seemingly innocuous question: "How strong does a password need to be for it to be physically impossible to brute-force, ever?"
_Note: this post contains equations. Since none of the equations were long or complex, I decided to just write them out in code blocks instead of using images or MathML the way Wikipedia does._
I realize that advice on password strength can get outdated. As supercomputers grow more powerful, password strength recommendations need to be updated to resist stronger brute-force attacks. Passwords that are strong today might be weak in the future. **How long should a password be in order for it to be physically impossible to brute-force, ever?**
This question might not be especially practical, but it's fun to analyze and offers interesting perspective regarding sane upper-limits on password strength.
Instead of predicting what tomorrow's computers may be able to do, let's examine the _biggest possible brute-force attack_ that the laws of physics can allow.
A supercomputer is probably faster than your phone; however, given enough time, both are capable of doing the same calculations. If time isn't the bottleneck, energy usage is. More efficient computers can flip more bits with a finite amount of energy.
In other words, energy efficiency and energy availability are the two fundamental bottlenecks of computing. What happens when a computer with the highest theoretical energy efficiency is limited only by the mass-energy of _the entire [observable universe](https://en.wikipedia.org/wiki/Observable_universe)?_
Let's call this absolute unit of an energy-efficient computer the MOAC (Mother of All Computers). For all classical computers that are made of matter, do work to compute, and are bound by the conservation of energy, the MOAC represents a finite yet unreachable limit of computational power. And yes, it can play Solitaire with _amazing_ framerates.
_A previous version of this section wasn't clear and accurate. I've since removed the offending bits and added a clarification about salting/hashing to the [Caveats and estimates](#caveats-and-estimates) section._
A good measure of password strength is **entropy bits.** The entropy bits in a password is a base-2 logarithm of the number of guesses required to brute-force it.[^1]
A brute-force attack that executes 2<sup>n</sup> guesses is certain to crack a password with <var>n</var> entropy bits, and has a one-in-two chance of cracking a password with <var>n</var>+1 entropy bits.
For scale, [AES-256](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) encryption is currently the industry standard for strong symmetric encryption, and uses key lengths of 256-bits. An exhaustive key search over a 256-bit key space would be up against its 2<sup>256</sup> possible permutations. When using AES-256 encryption with a key derived from a password with more than 256 entropy bits, the entropy of the AES key is the bottleneck; an attacker would fare better by doing an exhaustive key search for the AES key than a brute-force attack for the password.
To calculate the entropy of a password, I recommend using a tool such as [zxcvbn](https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler) or [KeePassXC](https://keepassxc.org/).
Define a function <var>P</var>. <var>P</var> determines the probability that MOAC will correctly guess a password with <var>n</var> bits of entropy after using <var>e</var> energy:
If <var>P</var>(<var>n</var>, <var>e</var>) ≥ 1, the MOAC will certainly guess your password before running out of energy. The lower <var>P</var>(<var>n</var>, <var>e</var>) is, the less likely it is for the MOAC to guess your password.
A brute-force attack will just guess a single password until the right one is found. Brute-force attacks won't "decrypt" stored passwords, because they're not supposed to be stored encrypted; they're typically [salted](https://en.wikipedia.org/wiki/Salt_(cryptography)) and hashed.
When estimating, we'll prefer higher estimates that increase the odds of it guessing a password; after all, the point of this exercise is to establish an _upper_ limit on password strength. We'll also simplify: for instance, the MOAC will not waste any heat, and the only way it can guess a password is through brute-forcing. Focusing on too many details would defeat the point of this thought experiment.
Quantum computers can use [Grover's algorithm](https://en.wikipedia.org/wiki/Grover%27s_algorithm) for an exponential speed-up; to account for quantum computers using Grover's algorithm, calculate <var>P</var>(<var>n</var>/2, <var>e</var>) instead.
Others are better equipped to explain encryption/hashing/key-derivation algorithms, so I won't; this is just a pure and simple brute-force attack given precomputed password entropy, assuming that the cryptography is bulletproof.
Obviously, I'm not taking into account future mathematical advances; my crystal ball broke after I asked it if humanity would ever develop the technology to make anime real.
Finally, there's always a non-zero probability of a brute-force attack guessing a password with a given entropy. Literal "immunity" is impossible. Lowering this probability to statistical insignificance renders our password practically immune to brute-force attacks.
How much energy does MOAC use per guess during a brute-force attack? In the context of this thought experiment, this number should be unrealistically low. I settled on [<var>k</var><var>T</var>](https://en.wikipedia.org/wiki/KT_(energy)). <var>k</var> represents the [Boltzmann Constant](https://en.wikipedia.org/wiki/Boltzmann_constant) (about 1.381×10<sup>-23</sup> J/K) and <var>T</var> represents the temperature of the system. Their product corresponds to the amount of heat required to create a 1 nat increase in a system's entropy.
A more involved approach to picking a good value might utilize the [Plank-Einstein relation](https://en.wikipedia.org/wiki/Planck%E2%80%93Einstein_relation).
It's also probably a better idea to make this value an estimate for flipping a single bit, and to estimate the average number of bit-flips it takes to make a single password guess. If that bothers you, pick a number <var>b</var> you believe to be a good estimate for a bit-flip-count and calculate <var>P</var>(<var>n</var>+<var>b</var>, <var>e</var>) instead of <var>P</var>(<var>n</var>, <var>e</var>).
A good value for <var>T</var> would be the average temperature of the entire observable universe. The universe is mostly empty; <var>T</var> is around the temperature of cosmic background radiation in space. The lowest reasonable estimate for this temperature is 2.7 degrees Kelvin.[^2] A lower temperature means less energy usage, less energy usage allows more computations, and more computations raises the upper limit on password strength.
Every guess, the MOAC expends <var>k</var><var>T</var> energy. Let <var>E</var> = the total amount of energy the MOAC can use; let <var>B</var> = the maximum number of guesses the MOAC can execute before running out of energy.
Now, given the maximum number of passwords the MOAC can guess <var>B</var> and the bits of entropy in our password <var>n</var>, we have an equation for the probability that the MOAC will guess our password:
The MOAC can use the entire mass-energy of the observable universe.[^3] Simply stuff the observable universe into the attached 100% efficient furnace, turn on the burner, and generate power for the computer. You might need to ask a friend for help.
We're trying to find <var>E</var> and we know <var>c</var>, the speed of light, is 299,792,458 m/s. That leaves <var>m</var>. What's the mass of the observable universe?
Critical density is smallest average density of matter required to _almost_ slow the expansion of the universe to a stop. Any more dense, and expansion will stop; any less, and expansion will never stop.
Let <var>D</var> = critical density of the observable universe and <var>V</var> = volume of the observable universe. Mass is the product of density and volume:
Where <var>G</var> is the [Gravitational Constant](https://en.wikipedia.org/wiki/Gravitational_constant) and <var>Hₒ</var> is the [Hubble Constant](https://en.wikipedia.org/wiki/Hubble%27s_law). <var>Hₒ</var><var>d</var> is the rate of expansion at proper distance <var>d</var>.
Let's assume the observable universe is a sphere, expanding at the speed of light ever since the Big Bang.[^4] The volume <var>V</var> of our spherical universe when given its radius <var>r</var> is:
If your threat model is a bit smaller, simulate putting a smaller object into the MOAC's furnace. For example, the Earth has a mass of 5.972×10²⁴ kg; this gives the MOAC a one-in-ten-trillion chance of cracking a password with 256 entropy bits and a 100% chance of cracking a 213-bit password.
Question: How much entropy should a password have to ensure it will _never_ be vulnerable to a brute-force attack? Can an impossibly efficient computer---the MOAC---crack your password?
Answer: limited only by energy, if a computer with the highest level of efficiency physically possible is made of matter, does work to compute, and obeys the conservation of energy:
- A password with 256 bits of entropy is practically immune to brute-force attacks large enough to quite literally burn the world, but is quite trivial to crack with a universe-scale fuel source.
- A password with 327 bits of entropy is nearly impossible to crack even if you burn the whole observable universe trying to do so.
Check out Scott Aaronson's article, [Cosmology and Complexity](https://www.scottaaronson.com/democritus/lec20.html). He uses an alternative approach to finding the maximum bits we can work with: he simply inverts the [cosmological constant](https://en.wikipedia.org/wiki/Cosmological_constant).
This model takes into account more than just the mass of the observable universe. While we previously found that the MOAC can brute-force a password with 306.76 entropy bits, this model allows the same for up to 405.3 bits.
This article's approach deliberately disregards computation speed, focusing only on energy required to finish a set of computations. Other approaches account for physical limits on computation speed.
One well-known approach to calculating physical limits of computation is [Bremermann's limit](https://en.wikipedia.org/wiki/Bremermann%27s_limit), which calculates the speed of computation given a finite amount of mass. This article's approach disregards time, focusing only on mass-energy equivalence.
{{<mention-workitemtype="ScholarlyArticle">}}{{<cited-workname="Ultimate physical limits to computation"extraName="headline"url="https://arxiv.org/abs/quant-ph/9908043">}} by {{<indieweb-personitemprop="author"first-name="Seth"last-name="Lloyd"url="https://meche.mit.edu/people/faculty/SLLOYD@MIT.EDU">}}{{</mention-work>}} further explores limits to computation speed on an ideal 1-kilogram computer.
Thanks to {{<indieweb-personitemprop="mentions"first-name="Barna"last-name="Zsombor"url="https://bzsombor.web.elte.hu/">}} and {{<indieweb-personitemprop="mentions"first-name="Ryan"last-name="Coyler"url="https://rcolyer.net/">}} for helping me over IRC with my shaky physics and pointing out the caveats of my approach. u/RisenSteam on Reddit also corrected an incorrect reference to AES-256 encryption by bringing up salts.
My notes from Thermal Physics weren't enough to write this; various Wikipedia articles were also quite helpful, most of which were linked in the body of the article.
While I was struggling to come up with a good expression for the minimum energy used per password guess, I stumbled upon {{<mention-workitemprop="citation"itemtype="Book">}}{{<cited-workname="Applied Cryptography"url="https://www.schneier.com/books/applied-cryptography/">}} by {{<indieweb-personitemprop="author"first-name="Bruce"last-name="Schneier"url="https://schneier.com/">}}{{</mention-work>}}. An excerpt [on his blog](https://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html) involving setting the minimum energy per computation to <var>k</var><var>T</var>. I chose a more conservative estimate for <var>T</var> than Schneier did, and a _much_ greater source of energy.
[^1]: <spanitemprop="citation">James Massey (1994). "Guessing and entropy" (PDF). Proceedings of 1994 IEEE International Symposium on Information Theory. IEEE. p.204.</span>
[^3]: The MOAC 2 was supposed to be able to consume other sources of energy such as dark matter and dark energy. Unfortunately, Intergalactic Business Machines ran out of funds since all their previous funds, being made of matter, were consumed by the original MOAC.
[^4]: This is a massive oversimplification; there isn't a single answer to the question "What is the volume of the observable universe?" Using this speed-of-light approach is one of multiple valid perspectives. The absolute size of the observable universe is much greater due to the way expansion works, but stuffing that into the MOAC's furnace would require moving mass faster than the speed of light.
