Both of you are correct, just talking about different things. PBKDF2 rounds are clearly sequential. Meanwhile, you can issue multiple simultaneous requests in

Both of you are correct, just talking about different things. PBKDF2 rounds are clearly sequential. Meanwhile, you can issue multiple simultaneous requests in parallel to try to authenticate the credentials, possibly from a large bank of distinct hosts.