Hacker News new | ask | show | jobs
by Scaevolus 2524 days ago
Sia's seeds are ridiculous-- the 29 words provide 300 bits of entropy. 100 bits would be a sufficient security margin against brute forcing, assuming a modern memory-hard KDF like Argon2.

With a 100 bit password, assuming every flop of the 1.8 exaflops of the Top500 supercomputers tested a new password, it would still take 25,000 years to crack. Key stretching should add at least 30 bits of security by taking a billion operations--

    $ perf stat argon2 asdfasdf -id -m 16 -t 16 <<< asdf
    Type:  Argon2id
    Iterations: 16 
    Memory:  65536 KiB
    0.781 seconds

         6,331,020,712      cycles                    #    4.021 GHz                    
        13,467,211,117      instructions              #    2.13  insn per cycle         

Here's what 100 bits of security margin looks like with a more sophisticated scheme (abbrase): "Hope raised between unpleasant bellows. Devil rode sullenly, refugees waiting." => (first three letters) hopraibetunpbeldevrodsulrefwai.