the case of 99% of human-made password will be up to 100,000
I guess this is intended to mean that 99% of human-made passwords are found within 100,000 attempts. This is way off.
With common-grade passwords, testing the 105 most common passwords is thought to find less than half of them. This is relatively well documented, testable, and can be modeled to a degree by Zipf's law; see this readable blog, or e.g. this.
It's harder to tell the number of passwords to test in order to find 99% of them. If we take the LinkedIn leak as reference, which reportedly was unsalted SHA-1 hashes of user passwords for approximately 117×106 accounts, by this source "only" 60 665 420 of the 61 829 262 unique hashes have been cracked. That is 1-(61 829 262-60 665 420)/117 000 000=99,01% at most of the accounts had their passwords cracked, with enormous effort, which I guess was at least 1012 passwords tested (I admit I have no reliable way to estimate that number).
decryption of encrypted message will just take minutes, right? Did I miss something?
With common-grade password, the hypothesis of PBKDF2-HMAC-SHA-256 and 104 rounds, and if (as is likely) there is a comparably fast/low cost test of whether the result of PBKDF2 is the correct encryption key, with 105 passwords tested that is 104+5 HMAC-SHA-256 (twice that many SHA-256), again the probability to find the password is way less than 99%, much closer to 50%, probably less. How much time that takes depends enormously on the resources used. The question reports 5×106 HMAC-SHA-256 per second. But many GPUs can do 108/s. FPGAs and ASICs can raise this tremendously: e.g. this, if it's SHA256d hashing rate was repurposable for HMAC-SHA-256 and encryption key search, would do nearly 1014/s.
- PBKDF2 was already a disputable choice a key stretching function for password-to-key derivation when it was introduced. It has become disastrous with the rise of GPUs, FPGAs and ASICs. Endorsing PBKDF2 is technically unjustifiable, when we now have memory hard functions, like Argon2, that do a much better job of leveraging the (essentially, RAM) resources of a modern CPU.
- 104 rounds of PBKDF2 is now ludicrously low for an encryption application, where key stretching is the primary line of defense (beyond sound choice of passphrase). It was barely enough by 2000 for password protection, where secrecy of the database of hashed password is expected. And by a simplified variant of Moore's law, we should increase the round count by a factor of 10 every 10 years to keep the same security level; and that's far from conservative.