Re: [kitten] Password KDF settings on draft-ietf-kitten-password-storage-01

[[e-mail]]

Oops I didn't reply on list:

> On 11/03/2020 5:39 PM [e-mail] wrote:
> 
>  
> > On 11/01/2020 4:10 AM Sam Whited <[e-mail]> wrote:
> > 
> >  
> > On Sat, Oct 31, 2020, at 21:01, [e-mail] wrote:
> > > Note that the recommendation from OWASP for bcrypt was briefly changed
> > > to cost 12 by one person and switched back to cost 10. Their defense
> > > cited your draft as why to keep it at cost 12. Until I pointed out
> > > that they are now citing each other.
> > 
> > Oh yes, that's definitely not good; the document I see
> > (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#bcrypt)
> > still shows 12 though, do they have other recommendations listed
> > somewhere else?
> 
> If you are taking bcrypt cost 12 from OWASP, then you should take PBKDF2 100,000 iterations too. Since those are the "well if you can, go for these numbers". Just a reminder bcrypt cost is exponential so cost 12 is 16 times harder than cost 8 and cost 8 is equivalent to PBKDF2-SHA256 300,000 iterations. Note both cost 8 and 300,000 iterations are just over 10 kH/s/GPU thus are considered not good.
> 
> "The default work factor for Bcrypt is 10, and this should generally be raised to 12 unless operating on older or lower-powered systems."
> 
> "The work factor for PBKDF2 is implemented through the iteration count, which should be at least 10,000 (although values of up to 100,000 may be appropriate in higher security environments)."