23 ms·

Couldn't the client send the number?

• runnerup 4y ago
  Yes but the server has to have something stored. If the data stored was last encrypted with a hash that has fewer iterations then the client side, then 1) the data cannot be decrypted with a hash of more iterations because the server can’t undo client side hash iterations. 2) if the encrypted data is exfiltrated it will still be as easy to crack as the iterations performed for the original encryption of the data at last login ten years ago.