Does using a random number of iterations for PKBDF2-SHA256 help if I only have to protect one key used to encrypt a password protecteded file? [duplicate]

Question

I read about Recommended # of iterations when using PBKDF2-SHA256?

I have also read in Why not just use a small but unusual number of hashing rounds? that when there are multiple password to protect, the moment one is cracked the hacker will know for all passwords which is the number of iterations required. But if I have to protect just one file with one password (or a very limited number of files with the same password), does it make sense if instead of selecting 100000 iterations to protect the password I use a "random" number like 97334? Or is there an easy way for the attacker to know how many iterations they need to run?

The tool used in OpenSSL, and the attacker will have the encrypted file(s). The number of iterations to encrypt the key is not visible to the attacker.

Answer 1

You are essentially trying to use the number of rounds as a pepper. Only problem is that the number of rounds is included in the full output of PBKDF2, and therefore known to the attacker.

$pbkdf2-sha256$6400$.6UI/S.nXIk8jcbdHx3Fhg$98jZicV16ODfEsEZeYPGHU3kbrUrvUEXOPimVSQDD44
               ^^^^ There it is!

You could use a different number of rounds than printed to confuse the attacker, but then you would be fiddling with the algorithm and risk making a fatal mistake.

An actual pepper, encrypting the hash or just increasing the entropy of the password would be better ways to increase your security.