If you had all the computing power physically possible in the universe, what key size could you brute-force?
With "outrageous resources" — all the sun's energy reaching Earth for a year, or the whole planet turned into storage — you top out at roughly 157-bit keys. That is a hard physical ceiling on brute force.
The ceiling can be reached from two independent directions that agree on the order of magnitude:
1. All solar energy for one year (compute bound): the total solar energy striking Earth in a year, spent entirely on testing keys, searches a keyspace of about 157 bits.
2. The whole Earth as storage (memory bound): if the entire planet were silicon used as a hard drive, it could hold a precomputed lookup table for about 157-bit keys.
3. A "crazy" back-of-the-envelope cluster lands in the same range. Assume 80 billion people, each with 10,000 supercomputers at $10^{16}$ operations/second, all running since humanity began (1.5 million years, at $3 \times 10^7$ seconds/year):
$$3 \times 10^7 \times 1.5 \times 10^6 \times 8 \times 10^{10} \times 10^{4} \times 10^{16} = 36 \times 10^{43} \approx 3.6 \times 10^{44}$$
$$\log_2(3.6 \times 10^{44}) \approx \mathbf{148}\ \text{bits}$$
(The population is $80\ \text{billion} = 8 \times 10^{10}$ — a tempting factor-100 slip to $8 \times 10^{12}$ would inflate the answer by about 7 bits to ~154. These estimates are easily off by a bit or two; the point is the ceiling sits near 150 bits, not its last digit.)
What this means:
- A 128-bit key is breakable in principle with planet-scale resources — but only barely, and no real adversary has anything close.
- A 256-bit key is beyond any conceivable physical computation — $2^{256} \approx 10^{77}$, dwarfing even $10^{45}$ — which is why AES-256 is considered permanently secure against classical brute force.
- Even a quantum computer only pulls $2^{256}$ down to $2^{128}$ (Grover) — still past the physical limit.
Go deeper:
Key size (Wikipedia) — why 256-bit keys are effectively unbreakable.- Brute-force attack (Wikipedia) — the theoretical-limits section.