Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm using PBKDF2 to derivate passwords but I never know what can be considered as a "sufficient" value for the iteration count.
Technology evolves very fast and I would also like to know how often and how much I should increase the value (eg: +20% every year).
There is no "sufficient" count, because user-chosen passwords can always be utterly weak, regardless of how well you coach them. You want the count to be the highest value that you can tolerate.
Remember that increasing the iteration count mechanically increases the operational cost. So you will have to set the count to a value which is low enough for your machine to still be able to process passwords in a timely manner. This is an analysis that you must make yourself, because it depends on your hardware and the expected peak load, and user tolerance to delays. Higher iteration counts tend to increase vulnerability to denial-of-service attacks.
You do not increase the iteration count on a regular basis to match "average technology". You increase the iteration count when you can afford it, which depends not on the general availability of faster servers, but on the servers that you actually bought and are using. Thus, you plan for an iteration count increase whenever you buy new hardware.
