Is AES GCM with PBKDF2 100k iterations still ok as of 2022?

Question

Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022?

In our threat model, if we ignore the risks linked to quantum computing, is this secure?

Here is an example working Python implementation:

import Crypto.Random, Crypto.Protocol.KDF, Crypto.Cipher.AES
plaintext = b"hello world hello world hello world hello world hello world"
password = b"correct horse battery staple"
nonce = Crypto.Random.new().read(16)
key = Crypto.Protocol.KDF.PBKDF2(password, nonce, count=100000)
cipher = Crypto.Cipher.AES.new(key, Crypto.Cipher.AES.MODE_GCM, nonce=nonce, mac_len=16)
ciphertext = (nonce,) + cipher.encrypt_and_digest(plaintext)  # nonce | ciphertext | tag
print(ciphertext)

Note: using the same nonce for PBKDF2 and AES.new(...) seems not to be a problem if we never re-use this nonce for future encryptions, see Reusing PBKDF2 salt for AES/GCM as IV: dangerous?

Answer 1

It depends entirely on how strong the password is. 100,000 rounds of PBKDF2 for a password with a given hash adds the equivalent of $\log_2(100000) \approx 16.6$ bits of entropy compared to a single round of that hash. If the password itself is already very strong, then you don't even need PBKDF2. The only purpose of a slow KDF is to improve the security of passwords of marginal strength. If your password has only, say, 64 bits of entropy, then 1000,000 iterations would likely put it out of reach of an attacker with \$1M of assets, because 64 + 16.6 = 80.6 bits, which would likely cost more than \$1M to break.

It's better to use a memory-hard KDF. This isn't because PBKDF2 is broken per se, but is because an attacker can more easily scale up an attack due to hashing lending itself to extreme parallelism.