Re: [kitten] draft-hansen-scram-sha256 and the hash iteration count

[Tony Hansen <[e-mail]>]

On 2/24/15 11:55 AM, Dave Cridland wrote:
>
> On 24 February 2015 at 16:33, Tony Hansen <[e-mail] 
> <mailto:[e-mail]>> wrote many things...
>
> As a thought, is it not worthwhile to distill all this into a 
> paragraph or two within the Security Considerations, such as:
>
> The strength of this mechanism is dependent in part on the iteration 
> count, as denoted by "i" in [RFC 5802]. As a rule of thumb, the 
> iteration count should be such that a modern machine will take 0.1 
> seconds to perform the complete algorithm; however this is unlikely to 
> be practical on mobile devices and other relatively low-performance 
> systems. At the time this was written, the rule of thumb gives around 
> 15,000 iterations required; however an iteration count of 4096 takes 
> around 0.5 seconds on current mobile handsets. This computational cost 
> can be avoided by caching the ClientKey (assuming the Salt and 
> iteration count is stable).
>
> Therefore the recommendation of this specification is that the 
> iteration count SHOULD be at least 4096, but careful consideration 
> ought to be given to using a significantly higher value, particularly 
> where mobile use is less important.

Thank you Dave. I think this is an excellent path forward.

     Tony Hansen