This is a question about standard every day web authentication.
I have the following assumptions:
- one of the reasons public key user authentication is not used as bread and butter on the web is that it is expensive for the server to verify signatures (the other is that it is not convenient for the client, but let's ignore that for now and in practice server operators have bigger role in decision making)
- on the other hand massive password breaches in the last years and quickly growing computing power available for cracking hashed passwords pushes the state of the art towards more and more expensive KDFs - more rounds of PBKDF2, argon2 with high parameters etc
- established public key schemes are secure against direct cracking
My question is: what is the proportion of computational cost (burden) on the server for verifying signatures on a supposed challenge (say, with ed25519) versus the cost of stretching passwords according to the up to date standards.