From the same paper: > By using a key derivation function which requires 2s cryptographic operations to compute, the cost of performing a brute-force attack ag

From the same paper: > By using a key derivation function which requires 2s cryptographic operations to compute, the cost of performing a brute-force attack against passwords with t bits of entropy is raised from 2t to 2s+t operations [19]. 1,000 iterations is just shy of 2^10.