Ideal passphrase length: old diceware method (5 words) vs. your Bitcoin wallet.dat passphrase length (8 words) and doubling passwords?

Question

I made a cool 5 word passphrase back then using the old Diceware method and use it as a master password. The question is: as computing power increases, will we need to add more and more words to our passphrases which we will eventually forget? I'm in my mid 30s, will passphrases be enough in my lifetime? :) So back then, Diceware suggested just 5 words, not the original Bitcoin QT client recommends 8 words. Will the original 5 words from the Diceware age serve me in the Bitcoin age?

I don't really want to mess around with a Yubikey. Heck, I Googled it and didn't really managed to find out what it is, what it does. Maybe I'm not the target market. I'm just a simple user. Carrying around a Yubikey would also be a red flag in my eyes. He has secrets!

How effective is doubling a passphrase? Like I have now [passphrase] and simply doule it: [passphrase][passphrase]. So I don't really have more stuff to remember, just more stuff to type. That might serve me for a time.

Answer 1

It is all a matter of how many bits of entropy your passphrase has (how hard it would be to guess). Using a couple words provides a lot more randomness than a couple random characters.

As far as I remember, the algorithm used to encrypt the private keys that is used by BitcoinQT has about 100 bits of security (which is a lot). You would want to attain a similar amount of security with your passphrase.

The english language has about 171000 words in it. But lets face it, most people won't use more than 60000. Assuming that your phrase would consist of lets say only the 10000 most popular words, you would need log_10000(2^100) words to achieve 100 bits of security, or about 7.5.

So using 8 words should be enough to secure your coins for a couple decades at least (assuming the current rate of computational speed growth). However, once the quantum computers enter the picture and become powerful enough, all guesses made now can be tossed out.

Answer 2

It seems to me that simply doubling your passphrase is sheer folly. Programs that try to guess passwords don't have to be super-smart to know that humans will often choose passwords with repetitions in them. In this brave new world, your old standards of password strength will just not be good enough. If you really want to be secure for many years to come, then you should take the advice of Satoshi -- he gave us the 256-bit private key because he believed that it would be strong enough to last a lifetime. If you use a key derived from a memorable pass-phrase ( even if it is fairly long ), then you are not taking advantage of the full 256-bits that Satoshi gave us. A pass-phrase that you think is pretty strong might last for a few years, and give you a false sense of security, until one day your money just disappears. That's the problem -- you will not have any warning until it is too late. I would not trust any long-term money to any pass-phrase, no matter how strong it seems to be. It's only a matter of time before you are hacked.

Answer 3

It seems that people need only about one bit of information per letter of English text. If you look for a scheme that will last your lifetime, you should assume that computers (and bitcoin pass phrase hackers) will become just as good. Then you may have as little as 4 to 6 bit information content per average word, maybe some more if you take care not to use meaningful phrases as your pass phrase. Put another way: I suspect that even 8 words (with maybe 32 to 48 bits of true information content) will be hackable with even today's computer once someone figures out how to teach them proper English. Pass phrase security is tricky.

EDIT:

1. If you look for "lifetime" security, don't forget that major advances in computer science (general breaking of all assymmetric crypto?) or technology (quantum computers?) could render much of the underlying applications you wish to secure obsolete, including the ECC behind the current Bitcoin protocol.

2. Looking at your diceware link, if you make a truly random choice of words from their list with nearly 7800 items, you obviously achieve an entropy per word given by the dual logaritm of 7800, which is 12.93 bits per word. Five such words would give you 64.6 bits of entropy and 8 such words amount to 103.4 bits of entropy. 64 bits are somewhat marginal for being called safe even just right now (depending on how much value you want to protect with it, maybe). The 103 bit value simply takes 550 billion times more effort to bruteforce...so to judge it to remain safe over a lifetime requires a stricter bound than that on the future cost of computation. Costs to bruteforce can be trivially improved by a factor in the millions by using a key-derivative function (e.g. scrypt), but that depends on the implementation, so if your question about passphrase safety is looking for general safety regardless of whether such additional passphrase hardening is used, this improvement cannot be assumed to happen.