Re: [kitten] draft-hansen-scram-sha256 and the hash iteration count

[Dave Cridland <[e-mail]>]

On 24 February 2015 at 16:33, Tony Hansen <[e-mail]> wrote many
things...

As a thought, is it not worthwhile to distill all this into a paragraph or
two within the Security Considerations, such as:

The strength of this mechanism is dependent in part on the iteration count,
as denoted by "i" in [RFC 5802]. As a rule of thumb, the iteration count
should be such that a modern machine will take 0.1 seconds to perform the
complete algorithm; however this is unlikely to be practical on mobile
devices and other relatively low-performance systems. At the time this was
written, the rule of thumb gives around 15,000 iterations required; however
an iteration count of 4096 takes around 0.5 seconds on current mobile
handsets. This computational cost can be avoided by caching the ClientKey
(assuming the Salt and iteration count is stable).

Therefore the recommendation of this specification is that the iteration
count SHOULD be at least 4096, but careful consideration ought to be given
to using a significantly higher value, particularly where mobile use is
less important.