# Cryptsetup | Given Enough Passphrase Entropy, Is It Necessary To Use a High Iteration Count?

Let's assume that, for creating a LUKS volume, I generate a random, 40 character passphrase that includes numbers, symbols, and upper and lower case letters, using the pwgen utility.

Given that the passphrase contains roughly 256 bits of entropy, if I use aes-xts-plain as my cipher, a 512 bit key, and sha512 for the hash, then would it be necessary (worth any reasonable gain) to also use a high iteration count -- say, 1 million, for the sake of example?

• Accurate but redundant, because small search space implies low entropy. The important thing isn't how many distinct passwords are possible (the size of the search space), but rather their probability distribution of the passwords (the function that assigns a probability to every password) and how it enables (or not) an attacker to succeed much sooner than a random search would by guessing likely passwords ahead of unlikely ones. An entropy of $b$ bits means the attacker, on average, succeeds after $2^{b-1}$ guesses. – Luis Casillas Nov 22 '16 at 22:55