I am building a client side app that will encrypt data, using password based key generation, into the database. Can someone verify my calculations to figure out what is the right number of iterations I should use to dissuade a potential hacker.

1. We'll assume that the password is at least eight characters long with a mix of numbers and upper, lower, and special characters. So that makes 72 possibilities per character

2. Thus total passwords to brute force = 72^8 = 722 trillion

3. If I want it to take 100 years to try all possibilities using 10 computers, then per second my settings should be able to produce 22,900 passwords

4. Now what I am unable to figure out is, how many iterations would it take to limit a GPU such as 8x Nvidia GTX 1080 to be able to generate 22,900 passwords?

We can assume HmacSHA1 or HmacSHA256

I am building a client-side app that will encrypt data, using password-based key generation, into the database. Can someone verify my calculations to figure out what is the right number of iterations I should use to dissuade a potential hacker?

1. We'll assume that the password is at least eight characters long with a mix of numbers and upper, lower, and special characters. So that makes $72$ possibilities per character

2. Thus total passwords to brute force $= 72^8 \approx 722$ trillion

3. If I want it to take 100 years to try all possibilities using 10 computers, then per second my settings should be able to produce 22,900 passwords

4. Now what I am unable to figure out is, how many iterations would it take to limit a GPU such as 8x Nvidia GTX 1080 to be able to generate 22,900 passwords?

We can assume HMAC-SHA-1 or HMAC-SHA-256.