Plenty principle
Security is a budget, not a sacred number.
State the threat, cross it with room to spare, then notice when an algorithm—not entropy—becomes the limiting component.
Hands-on evidence
Build a Plenty budget
Name the attacker, give them time, add a margin, and stop when another limit takes over.
Plenty
The effective strength clears both the threat model and the chosen margin.
Attacker ≈ 68 bitsPlenty Line 101Algorithm 128Your entropy 128
Threat budget68.1 bitsrate × parallelism × time
Plenty Line101 bitsthreat + 32-bit margin
Effective strength128 bitsentropy and algorithm match
Guessing success bound≈ 2^-60simplified uniform-search model
Where should you stop?
You crossed the chosen margin. More entropy may add complexity without improving this threat model.