Ironically this whole thread played out in the opposite direction at the time of SHA3's announcement: https://www.schneier.com/blog/archives/2012/10/keccak_is_

Ironically this whole thread played out in the opposite direction at the time of SHA3's announcement: https://www.schneier.com/blog/archives/2012/10/keccak_is_sha-3.html https://www.schneier.com/blog/archives/2012/10/keccak_is_sha... https://www.imperialviolet.org/2012/10/21/nist.html https://www.imperialviolet.org/2012/10/21/nist.html tl;dr: Keccak is not a good partner for PBKDF2. It has good hardware performance but comparatively poor software performance. This benefits attackers with FPGAs or better.