Ideal passphrase length: old diceware method (5 words) vs. your Bitcoin wallet.dat passphrase lenght (8 words) and doubling passwords?

Question

I made a cool 5 word passphrase back then using the old Diceware method and use it as a master password. The question is as computing power increases will we need to add more and more words to our passphrases which we will eventually forget? I'm in my mid 30s, will passphrases be enough in my lifetime? :) So back then, Diceware suggested just 5 words, not the original Bitcoin QT client recommends 8 words. Will theoriginal 5 words from the Diceware age will serve me in the Bitcoin age?

I don't really want to mess around with a Yubikey. Heck, I Googled it and didn't really managed to find out what it is, what it does. Maybe I'm not the target market. I'm just a simple user. Carrying around a Yubikey would also be a red flag in my eyes. He has secrets!

How effective is doubling a passphrase? Like I have now [passphrase] and simply doule it: [passphrase][passphrase]. So I don't really have more stuff to remember, just more stuff to type. That might serve me for a time.

Answer 1

It is all a matter of how many bits of entropy your passphrase has (how hard it would be to guess). Using a couple words provides a lot more randomness than a couple random characters.

As far as I remember, the algorithm used to encrypt the private keys that is used by BitcoinQT has about 100 bits of security (which is a lot). You would want to attain a similar amount of security with your passphrase.

The english language has about 171000 words in it. But lets face it, most people won't use more than 60000. Assuming that your phrase would consist of lets say only the 10000 most popular words, you would need log_10000(2^100) words to achieve 100 bits of security, or about 7.5.

So using 8 words should be enough to secure your coins for a couple decades at least (assuming the current rate of computational speed growth). However, once the quantum computers enter the picture and become powerful enough, all guesses made now can be tossed out.