Due to an ongoing discussion in my office, I was wondering if anyone had any comments on whether password hashing security needs to be very strong if client certificate validation is also required for account verification.
We use SHA-512 hashing with a randomized salt for password storage. It has been suggested that we don't need to iterate the hash function as we require BOTH password and a client certificate for user validation.
Is our account security significantly lower if we reduce the number of hash iterations taking into account we also require client certificate validation?
Since in some some cases we allow certificate-only validation, and in SOME cases (i.e. on developer machines) we allow password-only validation, I'm tempted to suggest that we allow a low number of iterations (or no extra iterations) of the hashing method for users that require client certificate validation, but require a normal number of hash iterations for users that don't. Does that make sense?