Because hashing is iterative, if the attacker doesn't know the number of rounds, they can compare the current result after each iteration to the target (stopping at some large limit like 2¹⁶–2¹⁸).

This approach falls squarely in "security though obscurity" territory, and undermines the purpose of iterating the hash.

Because hashing is iterative, if the attacker doesn't know the number of rounds, they can compare the current result after each iteration to the target (stopping at some large limit like 2¹⁶–2¹⁸).

This approach falls squarely in "security through obscurity" territory, and undermines the purpose of iterating the hash.