I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would cryptsetup use a technically less secure KDF, and opt for a high number of iterations?

  • What makes you think that PBKDF2 is "less secure" than bcrypt? – MechMK1 Jul 18 at 13:41
  • Just speculating, but it may have something to do with bcrypt's significantly higher memory usage and Linux's frequent usage in embedded environments, and that PBKDF2 is not inherently less secure, it just requires more iterations to achieve the same security. – Nic Hartley Jul 18 at 14:26
  • @MechMK1" when bcrypt has more resistance to brute forcing from gpus" – john doe Jul 18 at 14:28
  • 2
    Might be that whoever created it wanted something that could be FIPS 140 certified. PBKDF2 is an approved FIPS 140 algorithm. bcrypt is not. – Swashbuckler Jul 18 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.