seirdy.one/content/posts/password-strength.gmi

(This is a long post; there's a TLDR near the bottom.)

This is a tale of the intersection between thermal physics, cosmology, and a tiny amount of computer science to answer a seemingly innocuous question: "How strong does a password need to be for it to be physically impossible to brute-force, ever?"

Note: this post contains equations. Since none of the equations were long or complex, I decided to just write them out in code blocks instead of using images or MathML the way Wikipedia does.

Update: I implemented the ideas in this blog post (and more) in a program/library:

=> https://sr.ht/~seirdy/MOAC/ MOAC: Analyze and generate passwords using physical limits of computation

## Introduction

I realize that advice on password strength can get outdated. As supercomputers grow more powerful, password strength recommendations need to be updated to resist stronger brute-force attacks. Passwords that are strong today might be weak in the future. How long should a password be in order for it to be physically impossible to brute-force, ever?

This question might not be especially practical, but it's fun to analyze and offers interesting perspective regarding sane upper-limits on password strength.

## Asking the right question

Let's limit the scope of this article to passwords used in encryption/decryption. An attacker is trying to guess a password to decrypt something.

Instead of predicting what tomorrow's computers may be able to do, let's examine the biggest possible brute-force attack that the laws of physics can allow.

A supercomputer is probably faster than your phone; however, given enough time, both are capable of doing the same calculations. If time isn't the bottleneck, energy usage is. More efficient computers can flip more bits with a finite amount of energy.

In other words, energy efficiency and energy availability are the two fundamental bottlenecks of computing. What happens when a computer with the highest theoretical energy efficiency is limited only by the mass-energy of the entire observable universe?

=> https://en.wikipedia.org/wiki/Observable_universe Observable universe (Wikipedia)

Let's call this absolute unit of an energy-efficient computer the MOAC (Mother of All Computers). For all classical computers that are made of matter, do work to compute, and are bound by the conservation of energy, the MOAC represents a finite yet unreachable limit of computational power. And yes, it can play Solitaire with *amazing* framerates.

How strong should your password be for it to be safe from a brute-force attack by the MOAC?

### Quantifying password strength.

Note: a previous version of this section wasn't clear and accurate. I've since removed the offending bits and added a clarification about salting/hashing to the "Caveats and estimates" section.

A good measure of password strength is *entropy bits.* The entropy bits in a password is a base-2 logarithm of the number of guesses required to brute-force it.¹

A brute-force attack that executes 2ⁿ guesses is certain to crack a password with n entropy bits, and has a one-in-two chance of cracking a password with n+1 entropy bits.

For scale, AES-256 encryption is currently the industry standard for strong symmetric encryption, and uses key lengths of 256-bits. An exhaustive key search over a 256-bit key space would be up against its 2²⁵⁶ possible permutations. When using AES-256 encryption with a key derived from a password with more than 256 entropy bits, the entropy of the AES key is the bottleneck; an attacker would fare better by doing an exhaustive key search for the AES key than a brute-force attack for the password.

=> https://en.wikipedia.org/wiki/Advanced_Encryption_Standard Advanced Encryption Standard (Wikipedia)

To calculate the entropy of a password, I recommend using a tool such as zxcvbn or KeePassXC.

=> https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler zxcvbn: Low-Budget Password Strength Estimation 
=> https://keepassxc.org/ KeePassXC Password Manager

## The Problem

Define a function P. P determines the probability that MOAC will correctly guess a password with n bits of entropy after using e energy:

```
P(n, e)
```

If P(n, e) ≥ 1, the MOAC will certainly guess your password before running out of energy. The lower P(n, e) is, the less likely it is for the MOAC to guess your password.

## Caveats and estimates

I don't have a strong physics background.

A brute-force attack will just guess a single password until the right one is found. Brute-force attacks won't "decrypt" stored passwords, because they're not supposed to be stored encrypted; they're salted and hashed.

=> https://en.wikipedia.org/wiki/Salt_(cryptography) Salt (cryptography) (Wikipedia)

When estimating, we'll prefer higher estimates that increase the odds of it guessing a password; after all, the point of this exercise is to establish an *upper* limit on password strength. We'll also simplify: for instance, the MOAC will not waste any heat, and the only way it can guess a password is through brute-forcing. Focusing on too many details would defeat the point of this thought experiment.

Quantum computers can use Grover's algorithm for an exponential speed-up; to account for quantum computers using Grover's algorithm, calculate P(n/2, e) instead.

=> https://en.wikipedia.org/wiki/Grover%27s_algorithm Grover's algorithm (Wikipedia)

Others are better equipped to explain encryption/hashing/key-derivation algorithms, so I won't; this is just a pure and simple brute-force attack given precomputed password entropy, assuming that the cryptography is bulletproof.

Obviously, I'm not taking into account future mathematical advances; my crystal ball broke after I asked it if humanity would ever develop the technology to make anime real.

Finally, there's always a non-zero probability of a brute-force attack guessing a password with a given entropy. Literal "immunity" is impossible. Lowering this probability to statistical insignificance renders our password practically immune to brute-force attacks.

## Computation

How much energy does MOAC use per guess during a brute-force attack? In the context of this thought experiment, this number should be unrealistically low. I settled on kT. k represents the Boltzmann Constant (about 1.381×10⁻²³ J/K) and T represents the temperature of the system. Their product corresponds to the amount of heat required to create a 1 nat increase in a system's entropy.

=> https://en.wikipedia.org/wiki/KT_(energy) kT (Wikipedia)
=> https://en.wikipedia.org/wiki/Boltzmann_constant Boltzmann Constant (Wikipedia)

A more involved approach to picking a good value might utilize the Plank-Einstein relation.

=> https://en.wikipedia.org/wiki/Planck%E2%80%93Einstein_relation Plank-Einstein relation (Wikipedia)

It's also probably a better idea to make this value an estimate for flipping a single bit, and to estimate the average number of bit-flips it takes to make a single password guess. If that bothers you, pick a number b you believe to be a good estimate for a bit-flip-count and calculate P(n+b, e) instead of P(n, e).

What's the temperature of the system? Three pieces of information help us find out:

1. The MOAC is located somewhere in the observable universe
2. The MOAC will be consuming the entire observable universe
3. The universe is mostly empty

A good value for T would be the average temperature of the entire observable universe. The universe is mostly empty; T is around the temperature of cosmic background radiation in space. The lowest reasonable estimate for this temperature is 2.7 degrees Kelvin.² A lower temperature means less energy usage, less energy usage allows more computations, and more computations raises the upper limit on password strength.

Every guess, the MOAC expends kT energy. Let E = the total amount of energy the MOAC can use; let B = the maximum number of guesses the MOAC can execute before running out of energy.

```
B = E/(kT)
```

Now, given the maximum number of passwords the MOAC can guess B and the bits of entropy in our password n, we have an equation for the probability that the MOAC will guess our password:

```
P(n,B) = B/2ⁿ
```

Plug in our expression for B:

```
P(n,E) = E/(2ⁿkT)
```

### Calculating the mass-energy of the observable universe

How much energy can the MOAC use? It can use the entire mass-energy of the observable universe!³ Simply stuff the observable universe into the attached 100% efficient furnace, turn on the burner, and generate power for the computer. You might need to ask a friend for help.

Just how much energy is that? The mass-energy equivalence formula is quite simple:

```
E = mc²
```

We're trying to find E and we know c, the speed of light, is 299,792,458 m/s. That leaves m. What's the mass of the observable universe?

### Calculating the critical density of the observable universe

Critical density is smallest average density of matter required to *almost* slow the expansion of the universe to a stop. Any more dense, and expansion will stop; any less, and expansion will never stop.

Let D = critical density of the observable universe and V = volume of the observable universe. Mass is the product of density and volume:

```
m = DV
```

We can derive the value of D by solving for it in the Friedman equations:


=> https://en.wikipedia.org/wiki/Friedmann_equations Friedmann equations (Wikipedia)

```
D = 3Hₒ²/(8πG)
```

Where G is the Gravitational Constant and Hₒ is the Hubble Constant. Hₒd is the rate of expansion at proper distance d.

=> https://en.wikipedia.org/wiki/Gravitational_constant Gravitational constant (Wikipedia)
=> https://en.wikipedia.org/wiki/Hubble%27s_law Hubble's Law (Wikipedia)

Let's assume the observable universe is a sphere, expanding at the speed of light ever since the Big Bang.⁴ The volume V of our spherical universe when given its radius r is:

```
V = (4/3)πr³
```

To find the radius of the observable universe r, we can use the age of the universe t:

```
r = ct
```

Hubble's Law estimates the age of the universe to be around 1/Hₒ

### Solving for E

Let's plug in all the derived values into our original equation for the mass of the observable universe m:

```
m = DV
```

Remember when I opened the article by saying that none of the equations would be long or complex?

I lied.

```
m = (3Hₒ²/(8πG))(4/3)π(ct)³
m = c³/(2GHₒ)

E = mc²
E = c⁵/(2GHₒ)
```

Finally! We've found an expression for the total energy the MOAC can consume.

## Final Solution

```
P(n,E) = E/(2ⁿkT)
P(n, c⁵/(2GHₒ)) = c⁵/(2GHₒ*2ⁿkT)
```

Let's copy and paste the values for those constants from Wikipedia and Wolfram Alpha:

* c = 299,792,458 m/s
* G ≈ 6.67408×10⁻¹¹ m³/kg/s²
* Hₒ ≈ 2.2×10⁻¹⁸ Hz (uncertain; look up the Hubble tension)
* T ≈ 2.7 K
* k ≈ 1.3806503×10⁻²³ J/K

Plugging those in and simplifying:

P(n) ≈ 2.21×10⁹² / 2ⁿ

Here are some sample outputs:

* P(256) ≈ 1.9×10¹⁵ (password certainly cracked after burning 1.9 quadrillionth of the mass-energy of the observable universe).
* P(306.76) ≈ 1 (password certainly cracked after burning the mass-energy of the observable universe)
* P(310) ≈ 0.11 (about one in ten)
* P(326.6) ≈ 1.1×10⁻⁶ (about one in a million)

If your threat model is a bit smaller, simulate putting a smaller object into the MOAC's furnace. For example, the Earth has a mass of 5.972×10²⁴ kg; this gives the MOAC a one-in-ten-trillion chance of cracking a password with 256 entropy bits and a 100% chance of cracking a 213-bit password.

## Sample unbreakable passwords

According to KeePassXC's password generator, each of the following passwords has an entropy between 330 and 340 bits.

Using the extended-ASCII character set:

```
¦=¦FVõ)Çb^ÄwΡ=,°m°B9®;>3[°r:t®Ú"$3CG¨/Bq-y\;
```

Using the characters on a standard US QWERTY layout:

```
%nUzL2XR&Tz5hJfp2tiYBoBBX^vWo3`g6H#JSC#N6gWm#hVdD~ziD$YHW
```

Using only alphanumeric characters:

```
tp8D69CGWE5t5a9si5XNsw32CKyCafh8qGrKWLwE6KJHpGyUtcJDWpgRz5mFNx
```

An excerpt from a religious text with a trailing space:

```
I'd just like to interject for a moment. What you’re referring to as Linux, is in fact, GNU/Linux, 
```

Don't use actual excerpts from pre-existing works as your password.

## Conclusion/TLDR

Question: How much entropy should a password have to ensure it will never be vulnerable to a brute-force attack? Can the most theoretically powerful computer--the MOAC--crack your password?

Answer: limited only by energy, if a computer with the highest level of efficiency physically possible is made of matter, does work to compute, and obeys the conservation of energy:

* A password with 256 bits of entropy is practically immune to brute-force attacks large enough to quite literally burn the world, but is quite trivial to crack with a universe-scale fuel source.
* A password with 327 bits of entropy is nearly impossible to crack even if you burn the whole observable universe trying to do so.

At that point, a formidable threat would rather use other means to unlock your secrets:

=> https://xkcd.com/538/ xkcd 538: Security

## Further reading: alternative approaches

See Scott Aaronson's article on Cosmology and Complexity:

=> https://www.scottaaronson.com/democritus/lec20.html Cosmology and Complexity

He uses an alternative approach to finding the maximum bits we can work with: he simply inverts the cosmological constant.

=> https://en.wikipedia.org/wiki/Cosmological_constant Cosmological constant (Wikipedia)

This model takes into account more than just the mass of the observable universe. While we previously found that the MOAC can brute-force a password with 306.76 entropy bits, this model allows the same for up to 405.3 bits.

### Approaches that account for computation speed

This article's approach deliberately disregards computation speed, focusing only on energy required to finish a set of computations. Other approaches account for physical limits on computation speed.

One well-known approach to calculating physical limits of computation is Bremermann's limit, which calculates the speed of computation given a finite amount of mass.

=> https://en.wikipedia.org/wiki/Bremermann%27s_limit Bremermann's limit (Wikipedia)

A publication⁵ by Seth Lloyd from MIT further explores limits to computation speed on an ideal 1-kilogram computer:

=> https://arxiv.org/abs/quant-ph/9908043 Ultimate physical limits to computation

## Acknowledgements

Thanks to Barna Zsombor and Ryan Coyler for helping me over IRC with my shaky physics and pointing out the caveats of my approach. u/RisenSteam on Reddit also corrected an incorrect reference to AES-256 encryption by bringing up salts.

My notes from Thermal Physics weren't enough to write this; various Wikipedia articles were also quite helpful, most of which were linked in the body of the article.

While I was struggling to come up with a good expression for the minimum energy used per password guess, I stumbled upon a blog post by Bruce Schneier. It contained a useful excerpt from his book *Applied Cryptography*⁶ involving setting the minimum energy per computation to kT:

=> https://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html The Doghouse: Crypteto (Schneier on Security)

I chose a more conservative estimate for T than Schneier did, and a *much* greater source of energy.

## Citations and Footnotes

¹ James Massey (1994). "Guessing and entropy" (PDF). Proceedings of 1994 IEEE. International Symposium on Information Theory. IEEE. p. 204.

² Assis, A. K. T.; Neves, M. C. D. (3 July 1995). "History of the 2.7 K. Temperature Prior to Penzias and Wilson"

³ The MOAC 2 was supposed to be able to consume other sources of energy such as dark matter and dark energy. Unfortunately, Intergalactic Business Machines ran out of funds since all their previous funds, being made of matter, were consumed by the original MOAC.

⁴ This is a massive oversimplification; there isn't a single answer to the question "What is the volume of the universe?" Using this speed-of-light approach is one of multiple valid perspectives. The absolute size of the observable universe is much greater due to the way expansion works, but stuffing that into the MOAC's furnace would require moving mass faster than the speed of light.

⁵ Lloyd, S., “Ultimate Physical Limits to Computation,” Nature 406, 1047-1054, 2000.

⁶ Schneier, Bruce. Applied Cryptography, Second Edition, John Wiley & Sons, 1996.