3 ms·
20 rounds of PBKDF2, there's tears in my eyes.
by nwh 13y ago
20 rounds of PBKDF2, there's tears in my eyes.
- novaleaf 13y agowhat's so wrong with 20 rounds of pbkdf2? I don't know of any attacks that can defeat it in realistic time spans.
- nwh 13y agoA KDF is meant to slow down dictionary attacks by introducing a lot of computation. Normal values might be in the hundreds of thousands, even millions to bring the computation time down to less than a few a second on extremely high powered GPUs. 20 rounds has so little impact it's astonishing they even bothered to load the KDF library. Attacking encrypted files like this would be very fast for a motivated person, and when we know there's magic internet money involved there's a lot of motivated people.
- novaleaf 13y agodoing 20 rounds in a browser represents a non-trivial amount of work. that's much better than nothing, as it helps defeat existing rainbow tables. iirc, 1000 rounds will take a however as you suggest, on the server side, I would expect them to use a much higher 10k or so round count.