Imagine you're an adversary, and you've just stolen a list of hashed passwords. The values you see are: ae1fb1a0b0ee --> ??? f10abddc10a0 --> ??? What you'r

Imagine you're an adversary, and you've just stolen a list of hashed passwords. The values you see are: ae1fb1a0b0ee --> ??? f10abddc10a0 --> ??? What you're going to do is start bruteforcing letters until you find the matching passwords. You know that the passwords are hashed with 100k iterations, but you don't know how long the password is. First you start with a, b, c, d, ... z. That's 26 combinations. Then you do aa, ab, ac, ad, ... zz. That's another 26^2 (676) combinations. The next length of aaa, aab, aac, ... zzz is >17k combinations and it keeps increasing exponentially. Increasing the number of iterations applies a linear multiplier to the time. If it take 26ms to bruteforce all the one character hashes with 1000 iterations, it will take 2600ms with 100,000 iterations. But increasing the password length adds a multiplier of 26 with each new character (and that's only assuming single case letters). Adding 4 extra letters is actually an improvement of over 450,000x (26^4). (Assuming you are using the printable ASCII character set, that's actually 95^4 = 81,450,635x)