Let's suppose I have a bunch of PBKDF2 hashes in a database. For the sake of keeping this simple, let's say I've used 10 iterations. A few years later I decide to upgrade to 20 iterations. I want to upgrade all hashes in one go so I rehash the old hashes instead of waiting for all users to log in. Do I use 20 or 10 iterations?
Basically, what I'm asking is this:
pbkdf2(20, password) == pbkdf2(20, pbkdf2(10, password))
pbkdf2(20, password) == pbkdf2(10, pbkdf2(10, password))
== I mean equivalent in terms of security.
Which of the two is true?