Attack: We search using brute force by trying out different user-password combinations and generating a key-pair and verify it (against public key??) The keyspace corresponds to the space of user-password combinations. The complexity of the attack corresponds to the actual entropy in the keyspace.
Defence: the key generation is a rare operation (creation+recovery), make it expensive by key stretching.