# How many throws of a dice are necessary to defeat a brute force attack?

At bitaddress.org I have decided to use "Brain Wallet" and create my own physical randomness using dice. (I understand that dice are more effective than entering dozens of random keys on the keyboard.)

How many throws are necessary to create a passphrase which would defeat a brute force attack on my keys?

• I hope you mean a paper wallet, not a brain wallet. Brain wallets don't use any randomness. – David Schwartz Feb 14 '14 at 11:27

Rolling a single die has 6 possible results. A private key is a 256-bit number. But its address involves a 160-bit hash, so that's the most you need to use. To know how many dice rolls you need to get this much entropy, you need to know when 6^n > 2^160 (because the probability of a certain sequence of n die rolls is 1/6^n). This is equal to ceil(log(2)*160/log(6)) or 62.

So if you roll a die 62 times (or a pair of dice 31 times, etc. - but be sure to count the die separately, and in a consistent way - e.g. do not always write the smaller of the two first, because you'd remove some entropy), and write down the numbers in order (e.g. "132415614..."), you can use that to seed a crypto random number generator that can give you a private key as secure as is possibly useful.

Electrum's seed is 128 bits, and is considered (by those who created and use it, at least) to be secure enough for not just one private key, but all of your private keys. To match that entropy, you need 50 die rolls.

Every five dice add 12.9 bits of entropy. Minimum: 30 dice for 64 bits. Better: 60 dice for 128 bits.

https://en.wikipedia.org/wiki/Diceware

You can already use bitaddress to directly convert 6-sided die rolls into a private key. Go to "Wallet Details" and enter your die rolls in Base6 format (enter 0 for 6, 1 for 1, 2 for 2, 3 for 3, 4 for 4, 5 for 5). This requires 99 die rolls and assures 256 bits of entropy.

If you choose to hash a lower number of die rolls, then 50 rolls should assure 128 bits of entropy and be quite secure. You should not be satisfied with anything less than 80 bits of entropy, so 31 die rolls would be your bare minimum.