Novalissoide
Is this a reasonable interpretation of yours policy
@Murcielago & @userofgos
-- that you employ long & strong primary passwords. Is this out of concerns about the secure element?
Since I am not an expert regarding your question, I too rely on the knowledge of those who are, and I would rather quote them than give my own two cents (and I obviously don't claim to speak for @userofgos ):
Our recommendation is to choose whether or not you want to rely on the secure element throttling (Weaver) and then proceed based on your decision.
[...]
Random 6 digit PIN is a baseline where you depend entirely on Weaver for security. Random passphrase can have enough entropy to be secure even without the hardware features. It should have at least around 90 bit entropy to be secure against any attacker.
[...]
Please bear in mind that the passphrase is turned into a key via scrypt key derivation and then further key derivation is done with other inputs including the random Weaver token. The final phase is hardware-bound key derivation. If an attacker can exploit the secure element (exploiting the bootloader does not help), they can bypass the Weaver throttling. If an attacker can extract the key from the SoC, they can perform the final key derivation on a server farm instead of only on the device. They still need to run the key derivation algorithms. Your passphrase is not used as a key but rather is the most important input for deriving the key encryption key used to encrypt a random disk encryption key.
7 random diceware words or 18 random lowercase letters / numbers are both slightly above 90 bit entropy. If you want to completely avoid depending on hardware, that's the baseline for what you should use. You don't need 128 bits of entropy for a random passphrase to be secure against any attacker, but you may want more than 90 bits. 128 bits is an extreme overkill value used to design encryption algorithms. Part of the reason for using an extreme overkill value is in case there are partial breaks of the algorithms reducing their security, which is not relevant to a random passphrase used as input for key derivation.
source: https://discuss.grapheneos.org/d/4049-security-from-bruteforce/66