2
$\begingroup$

I am working on a project which needs to share messages, and part of that project is deriving a password, I am currently using a value of 65537, totally arbitrary (it is $2^{16} + 1$, so not TOTALLY) and that takes about 1-second to compute. but, I just wondered what value or iteration count is enough?

Note its just a hobby project, not a federal info. transfer thing.

$\endgroup$
  • $\begingroup$ What is your risk? who is your enemy? $\endgroup$ – kelalaka Oct 13 at 17:57
  • $\begingroup$ @kelalake no one. its just for fun. but in general, like a big company or something, what would be a good value? $\endgroup$ – Omer Enes Oct 13 at 18:14
  • $\begingroup$ NIST SP 800-63B recommends at least 10,000 but as long as as you can afford (so measure to hit 100ms - 1s if you can or as long as your users won't notice the latency too much) $\endgroup$ – SEJPM Oct 13 at 18:30
  • $\begingroup$ Can you pick a passphrase for each user, by a process with >128 bits of entropy, e.g. a string of ten words chosen independently and uniformly at random from a 7776-word list? If so, it doesn't really matter how many iterations of PBKDF2 you use, as long as you use a random salt per user. (If you use a process with 256 bits of entropy, like twenty words, then there's no need for a salt either.) $\endgroup$ – Squeamish Ossifrage Oct 14 at 0:45
2
$\begingroup$

what value or iteration count is enough?

So in NIST SP 800-63B a baseline of 10,000 iterations is recommended. Going below that is a really bad idea.

Now of course the actual guidance is "do as many iterations as you can afford", which usually amounts to "do as many as your users are willing to wait for". If 65,000 already take 1 second and your users will complain enough about that to go for a different application lower the value. If they're patiently waiting 5 seconds, go for the iteration count that takes 5 seconds.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.