I want to make it as hard as possible to brute force data I hash. How can I make hashing take X seconds?
Consider using key derivation functions like Argon2 or Lyra2. Unlike hash functions like SHA3 which are fast by design, key derivation functions are designed to consume much resources and make brute-forcing much harder.
Argon2 has for instance following parameters:
- The number of iterations
- Memory factor
- The number of threads or lanes
An attacker can use powerful CPUs or GPUs and run many brute-forcing processes in parallel. To limit such parallel computations you may increase the memory factor. Depending on the factor, this can mean higher costs for an attacker to buy/rent more memory.
On the other hand, keep in mind usability. If these data are requested often by users, may be they cannot wait to long, may be they will accept delays not more than 1-2 seconds.