I could be wrong (my physics background isn't that strong either) but I think Dyson's "time without end" paper <a href="http://www.aleph.se/Trans/Global/Omega/dyson.txt" rel="nofollow">http://www.aleph.se/Trans/Global/Omega/dyson.txt</a> shows that eventually the universe will cool down enough to make all keys brute-force-attackable despite Bremermann's limit.<p>Given a finite amount of attacker computation you're willing to defend against, you can get a real advantage from key stretching (though not from mere salting). If you want a password strength of 256 bits, you can memorize a password of 226 bits and require work equivalent to 2³⁰ key-hashing operations to derive the actual encryption key or crypted password. This is normally called a KDF; reasonable ones are scrypt, bcrypt, and Argon2, in ascending order of goodness.<p>If you make the work factor unreasonably large, you won't be able to use the password in practice, because you have to do that work every time you use it. For example, if you try to memorize 170 bits of password and use a 2¹⁷⁰ work factor in your KDF to reach the 340-bit security level, recommended here, you have to do 2¹⁷⁰ work on your laptop every time you log in. Assuming a trillion operations per second (a safe upper bound for current laptops) each login will take about 47 nonillion years, about a sextillion times longer than the history of the universe so far and about 50 times longer than the expected lifetime of the last galaxies (see <a href="https://en.m.wikipedia.org/wiki/Timeline_of_the_far_future" rel="nofollow">https://en.m.wikipedia.org/wiki/Timeline_of_the_far_future</a>). It may be inconvenient to wait that long.<p>For the same reason that a KDF is a safe way to derive keys for decrypting data at rest, in a client-server system, you can generally do this work on the client safely, so it doesn't pose a denial-of-service risk.