# Energy necessary for brute-forcing or decryption

I am trying to understand how the physical limits of computation apply to crytography, and came up with the scenario below as a sort of gedanken. I would be grateful to see how others answer it.

Assume that Alice

1. used the default GnuPG (aka "GPG") settings, except for the following:

• --s2k-cipher-algo AES256
• --s2k-digest-algo SHA512
• --cert-digest-algo SHA512
2. and then used GPG to create a 4096-bit RSA PGP encryption key pair whose private key is protected by a 10-word Diceware passphrase;

3. and then used the public key of that key pair to encrypt a plain text 1kB long;

4. and then stored the resulting ciphertext, along with the key pair, on a CD-ROM which she then gave to Bob, and nowhere else;

5. and then perished, vaporised by a meteorite along with the laptop she used to perform the above tasks, leaving Bob's CD the only record of her key pair and ciphertext.

Assume also the existence of a computer, bound by the physical limits of computation as presently understood (e.g. these), but otherwise optimised to efficiently perform the tasks in question (e.g. a hypothetical quantum computer).

Finally, assume that this computer is adequately powered, and immune to catastrophes (such as the death of the Sun), during its tasks.

What is the minimum energy, in SI units (i.e. J, or kJ, or MJ, etc), such a computer would require, in order to determine the plaintext, if the CD-ROM's data are available to it?

• Is the private key really supposed to be on Bob's CD? $\;$ – user991 May 3 '15 at 0:37
• It seems like it would be far more relevant to consider what happens if the "attacker" has the public key and the password-encrypted private key, rather than the key pair. $\;$ – user991 May 3 '15 at 2:26