One of my big problems with security-related topics is that sometimes it's hard to find clear instructions on what you should be doing. We should really have so

One of my big problems with security-related topics is that sometimes it's hard to find clear instructions on what you should be doing. We should really have something like a BCP [0] for non-security people. I think the closest thing we have is the Computer Security Resource Center [1], which isn't very approachable and friendly. One recent example I encountered: if I'm generating an ed25519 ssh key, how many KDF rounds should I use? I've seen some guides drop the flag completely, which apparently defaults to 16. But in other places I've seen people saying it should be 100. Is the default value sane or not? [0] https://en.wikipedia.org/wiki/Best_current_practice https://en.wikipedia.org/wiki/Best_current_practice [1] https://beta.csrc.nist.gov https://beta.csrc.nist.gov