I'm using PBKDF2 to derivate passwords but I never know what can be considered as a "sufficient" value for the iteration count.

Technology evolves very fast and I would also like to know how often and how much I should increase the value (eg: +20% every year).

1 Answer 1


There is no "sufficient" count, because user-chosen passwords can always be utterly weak, regardless of how well you coach them. You want the count to be the highest value that you can tolerate.

Remember that increasing the iteration count mechanically increases the operational cost. So you will have to set the count to a value which is low enough for your machine to still be able to process passwords in a timely manner. This is an analysis that you must make yourself, because it depends on your hardware and the expected peak load, and user tolerance to delays. Higher iteration counts tend to increase vulnerability to denial-of-service attacks.

You do not increase the iteration count on a regular basis to match "average technology". You increase the iteration count when you can afford it, which depends not on the general availability of faster servers, but on the servers that you actually bought and are using. Thus, you plan for an iteration count increase whenever you buy new hardware.

  • Thank you for the answer! I didn't think about the DDOS aspect, which is a very important point... Commented Mar 9, 2016 at 15:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .