1Password on Mastodon

Secret key, amount of entropy and future

oschifoschif
Community Member

Hello,
I have read that secret key is 128bits of entropy.

Wouldn't it be good idea to increase number of entropy to 256bit or more to future proof security of our vaults?

Lets say 1Password gets breached this year. Our vaults are in the open forever from now on. So what about 20 years in the future? Will 128bit of entropy still be enough and impossible to crack? How much entropy do we need to be safe for out lifetimes considering technology improvements?

Thanks.


1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser:_ Not Provided

Comments

  • sol42sol42
    Community Member
    edited January 18

    As someone whose (now former) LastPass vault is now in the open forever I will second this suggestion.

  • Dave_1PDave_1P

    Team Member

    Hello @oschif and @sol42! 👋

    Thank you for the feedback! 1Password uses 256-bit AES encryption to protect your data: About the 1Password security model

    The Secret Key itself is a 34 character string with 128 bits of entropy. However it's combined with your account password to create the private key that encrypts and protects your data. The resulting combination will have an entropy that combines the entropy of both the Secret Key and the account password. You can increase this combined entropy by making sure that you use a good and secure account password.

    You can read more about the Secret Key here: Secret Key - What Is It And How Does It Protect Users?

    Let me know if you have any questions. 🙂

    -Dave

  • oschifoschif
    Community Member

    @Dave_1P
    Well, to be honest, I expected some kind of reasoning why do you consider current security safe enough for next 20+ years.
    I see that in case of increasing number of iterations you explain that it would increase time of vault decryption and that you research methods of increasing security.
    https://1password.community/discussion/comment/673384/#Comment_673384

    But I don't see that you would consider longer secret key, so that's why I asked about it.

  • Dave_1PDave_1P

    Team Member
    edited January 26

    @oschif

    The Secret Key for your 1Password account, generated to have 128 bits of entropy, is already designed to protect your data against even the most cutting edge of GPU-accelerated cracking tools, brute forcing the Secret Key is infeasible. Using classical computers, brute forcing a 128-bit value is essentially impossible. Some upper-end estimates put the time required to brute force such a key as longer than the time the earth has remaining.

    Now, theoretical quantum computers add some complications to this but the story is still largely the same: barring some giant breakthrough in physics, that fundamentally changes what quantum computers are capable of, it's unlikely that quantum computers will be capable of performing an attack on a 128-bit Secret Key in any meaningful time period. I spoke to our security team about this and they said that: "Based on the most recent research, there’s no indication that increasing entropy of the secret key would provide any material benefit."

    So to circle back to your original question:

    So what about 20 years in the future? Will 128bit of entropy still be enough and impossible to crack? How much entropy do we need to be safe for out lifetimes considering technology improvements?

    The Secret Key's 128 bits of entropy, combined with the ~40-50 bits of entropy from a good account password, are more than enough to protect your data for your lifetime.

    -Dave

  • BenBen AWS Team

    Team Member
    edited January 26

    I would quickly add: technology is an ever-changing landscape. We continue to monitor the threats that are out there and adjust accordingly. We've built our service based on the dangers and constraints that exist today (and what we anticipate existing tomorrow), but if the landscape shifts, we can & will as well.

    There isn't a knee-jerk reaction for us to change our security based on what happened at LastPass. We had already anticipated the possibility of what happened there happening to us and built accordingly. We have protections in place against that sort of threat. That isn't to say that there may not be incremental improvements in the short term, but there isn't a mad rush to make significant changes because we're already protected.

    This article provides a deep-dive on the subject:

    Not in a million years: It can take far less to crack a LastPass password

    Ben

  • oschifoschif
    Community Member
    edited January 26

    Thank you very much for answering.
    I understand now that your security model is secure enough for foreseeable future and there is no immediate need for making radical changes.
    Helped me to feel safe using 1Password.

  • BenBen AWS Team

    Team Member

    You're most welcome, @oschif. 😃 If we can be of further assistance, please don't hesitate to contact us.

    Ben

Leave a Comment

BoldItalicStrikethroughOrdered listUnordered list
Image
Align leftAlign centerAlign rightToggle HTML viewToggle full pageToggle lights
Drop image/file