Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

13
  • 1
    Just an idea: Could one do like ~20k rounds on the client PC and than 1k on the server? If an attacker would start by guessing "normal passwords", he would still have to do 21k rounds. And if he'd start with keys, he'd only need to do 1k rounds, but the entropy should be much higher. Am I missing something? Seems like a good solution to me. Commented Dec 4, 2012 at 17:16
  • @cooky451: you can do that, but that can be hard to configure. Clients can use a wide variety of hardware, some of which very feeble when it comes to computing. Also, in a Web context, this means Javascript, and you will not get a lot of iterations out of a Javascript implementation of PBKDF2 (it would work much better with a Java applet, but that's yet another can of worms). Commented Dec 4, 2012 at 17:24
  • 2
    I don't understand how you got to 8ms in your example. If f=200, p=30 * 24 * 60 * 60 * 1000?, n=32 . Then v is 241ms? I transformed 1 month to millis. Not sure what I am doing wrong. Thanks for the answer Commented Aug 26, 2014 at 21:12
  • It does come out to 241ms. In fact, if you plug 8ms into the formula, you get approximately 23 hours out as "attacker patience". Which is a whole lot less than a month (for a single 32 bit entropy password)... And low enough where the recommended value of 8ms should likely be raised. Commented Sep 10, 2014 at 15:20
  • 1
    @CharlesWood I would say that needs to be a part of your risk model. If you have assets that are interesting to a nation-state, then I would approximate the attacker's capabilities to be quite high. If you are running a hot-or-not site, perhaps your attackers will be less well-equipped. This question (and answer) is fairly old, but BitWarden currently uses 600,001 rounds of PBKDF2 by default. OWASP currently recommends 600,000. I suspect these are fairly conservative settings based upon a fairly capable adversary. Commented Aug 23, 2023 at 14:17