Re: [kitten] Fwd: I-D Action: draft-hansen-scram-sha256-01.txt

[Russ Allbery <[e-mail]>]

Tony Hansen <[e-mail]> writes:
> On 8/8/14, 3:02 AM, Shawn M Emery wrote:

>> I know RFC 3962 calls for 4096 rounds for SHA-1.  I haven't heard of
>> anything that would make us want to change this.  Are there specific
>> use-cases for this mechanism that would be negatively affected when
>> choosing a higher iteration or is there guidance on policies when using
>> this number of iterations or lower?

> I am not aware of any guidance on how to choose an appropriate number of
> iterations.

The rule of thumb that I was told by the CS crypto faculty at Stanford was
to use a number of iterations such that string-to-key would take 0.1
seconds on a computer with typical current performance.  That may or may
not be practical, given...

> I do know that we found 4096 iterations to be significant on a handheld
> device, and I would *prefer* not raising it any higher. (We would not be
> willing to change our existing implementation of scram-sha-256 to a higher
> number unless there was a >>really good reason<<.)

...you're already seeing performance issues with 4,096, and my testing
showed that meeting that rule of thumb would require at least 14,500
iterations of SHA-2 with PBKDF2.

-- 
Russ Allbery ([e-mail])              <http://www.eyrie.org/~eagle/>