I estimated the cost of the pbkdf_bcrypt function that the new OpenSSH format uses. It's about 20-30ms for a derivation with default (nrounds=16) parameters. Th

I estimated the cost of the pbkdf_bcrypt function that the new OpenSSH format uses. It's about 20-30ms for a derivation with default (nrounds=16) parameters. That's fine, but it's not absurd to suggest you want nrounds=100 or so, to bump it up to 150-200ms. That's a noticeable delay, but it also makes recovering the password extremely costly, and you only pay the cost when you actually unlock the key (so, if you use ssh-agent, not on every git push, for example). You can check my (admittedly, first pass, back of the napkin) work here: https://gist.github.com/lvh/9f551c92e3b3347424a0c8dc61c73c2b https://gist.github.com/lvh/9f551c92e3b3347424a0c8dc61c73c2b