At what point does passphrase strength match the strength of the cipher?

Question

Let's say that I have an ordinary hard drive encrypted with VeraCrypt 1.0e full disk encryption and implementing:

-AES

-RIPEMD-160 Hash Algorithm

Now let's say that for an arbitrary machine, the amount time that it takes to make 1 guess at the master encryption key itself is equal to 1 unit of time. (I understand that, in practical terms, it is beyond infeasible to attempt to crack the master encryption key of AES-256. This is a purely theoretical question.) Knowing that VeraCrypt uses 327,661 iterations of PBKDF2-RIPEMD-160, how many units of time would it take to check 1 password?

What I am interested to know is, at what point K, where K is the keyspace of the randomly generated password, does the strength of the password match the strength of the cipher itself, knowing that the former will have to been run through 327,661 iterations of PBKDF2-RIPEMD-160 to arrive at the latter, where an equivalence of strength is defined as an equivalence of the amount of time that, on average, a brute-force attack would take.

Assuming that the amount of time that it would take for 1 iteration of PBKDF2 to occur = the amount of time that it would take to make 1 check at the master encryption key itself (which I DO NOT simply assume to be a correct assumption), then 327,661 iterations adds log(327661)/log(2) = 18.3 bits of entropy to the overall "strength" of the passphrase. It seems that finding an answer to my question would yield the logical upper-limit of password strength, the point after which it makes no sense to use a [password + key derivation function] whose average time to crack is longer than that of the cipher master encryption key itself.

Answer 1

If I'm not missing some important point here, that's rather trivial to calculate. As implicitly stated in your question, the attacker has two possible ways to brute-force the encryption key: either by brute-forcing the encryption key itself or by brute-forcing the user-entered password.

Given the numbers of iterations of the key derivation function n, the time per kdf iteration t_kdf, the length of the encryption key b (in bits) and the time per invocation of the actual encryption algorithm t_enc, the average time needed to crack the encryption key itself (by testing half of the available keyspace) is

1/2⋅2^b⋅t_enc.

The average time to crack the user-entered password is

1/2⋅K⋅(n⋅t_kdf+t_enc),

with K=c^l being the entirety of all passwords available to the user (c: number of characters available, l: length of password).

In your scenario, t_enc=t_kdf=1, and n=327661. Assuming AES-256 is used (b=256), one has to solve the equation

1/2⋅2^b⋅t_enc = 2²⁵⁶ = K⋅327662 = 1/2⋅K⋅(n⋅t_kdf+t_enc),

which yields (approximately) K=5.9447⋅10³⁵. Assuming an available keyspace of 90 characters (which most users aren't likely to even find on their keyboards), this translates to approximately l=36.

(Disclaimer: I'm neither a mathematician nor an crypto expert. In case of any mathematical or semantic error, please comment.)

Related: https://security.stackexchange.com/questions/74566/long-passwords-and-key-derivation-functions