I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would cryptsetup use a technically less secure KDF, and opt for a high number of iterations?

  • What makes you think that PBKDF2 is "less secure" than bcrypt?
    – MechMK1
    Jul 18 '19 at 13:41
  • Just speculating, but it may have something to do with bcrypt's significantly higher memory usage and Linux's frequent usage in embedded environments, and that PBKDF2 is not inherently less secure, it just requires more iterations to achieve the same security.
    – Nic
    Jul 18 '19 at 14:26
  • @MechMK1" when bcrypt has more resistance to brute forcing from gpus"
    – john doe
    Jul 18 '19 at 14:28
  • 2
    Might be that whoever created it wanted something that could be FIPS 140 certified. PBKDF2 is an approved FIPS 140 algorithm. bcrypt is not. Jul 18 '19 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.