Thread by @benwr

If you care about password strength: you want to measure strength in terms of the min-entropy of the randomized method you use to choose (). But how much min-entropy should a password have? (1/n)benwr.net/2022/01/16/pas…

Well, I use a password manager to generate and store ~all of my passwords. I don't care how hard they are to memorize, so I generate crazy-long ones. But there's an important exception: The password for my password manager! How strong does that one need to be? (2/n)

Important questions: "how long do I want to be safe for?" and "safe against what kind of attacker?". But, if you want to ignore this question and be safe anyway, one option is "I want to be safe for 20 years, against one year of the entire world's cracking capacity." (3/n)

Let's make some crazy-conservative assumptions:

1. A cracking attempt can be done with a single floating-point op
2. N quantum gates can do the equivalent of N^2 floating-point ops worth of password cracking attempts, using Grover's algorithm
3. compute doubles every year
(4/n)

Globally < ~10^24 = 2^80 classical ops/s. Quantum gates is harder to estimate, but I think currently less than 10^8 = 2^27 gates/s.
If both double yearly, classical will dominate for about 15 years. But since we want 20 years of security, we care more about quantum. (5/n)

2^27 gates/s doubled for 20 years gives 2^47 gates/s. pi seconds is a nanocentury: 3.15e7 seconds in a year, so 2^25 * 2^47 = 2^72 gates/year. Double that (quantum, remember?) to get 144 bits of cracking capacity. ~11 diceware words. Not impossible to remember! (6/n)

So that's the rough answer: 11 diceware words "should be enough for anybody". (7/7 but will add links in further replies)

Estimates of global classical compute:

*
* wiki.aiimpacts.org/ai_timelines/h…
aiimpacts.org/global-computi…

Estimate of global quantum compute is based on this table:

plus this estimate of gates/s for a single machine: en.wikipedia.org/wiki/List_of_q…
quantumcomputing.stackexchange.com/posts/2404/rev…

Compute doubling yearly is a wild and crazy number I made up to be way too fast

Diceware: theworld.com/~reinhold/dice…

Addendum: Every additional diceware word you add should increase the timeframe by about 6 years.