Then we can use GPUs to speed up VeraCrypt's PBKDF, too. The point is that there's no need for a PBKDF that takes 10 seconds on modern hardware. Sure, that 60

Then we can use GPUs to speed up VeraCrypt's PBKDF, too. The point is that there's no need for a PBKDF that takes 10 seconds on modern hardware. Sure, that 60-bit passphrase is weak. But it takes a trivial amount of effort to increase the entropy of a passphrase. Let's say I increased it to 80 bits. In terms of brute-force resistance, that's equivalent to increasing the PBKDF's iteration count 1 million times.