I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would cryptsetup use a technically less secure KDF, and opt for a high number of iterations?
8
-
What makes you think that PBKDF2 is "less secure" than bcrypt?– user163495Jul 18, 2019 at 13:41
-
Just speculating, but it may have something to do with bcrypt's significantly higher memory usage and Linux's frequent usage in embedded environments, and that PBKDF2 is not inherently less secure, it just requires more iterations to achieve the same security.– anonJul 18, 2019 at 14:26
-
@MechMK1" when bcrypt has more resistance to brute forcing from gpus"– john doeJul 18, 2019 at 14:28
-
See this question What's the advantage of using PBKDF2 vs SHA256 to generate an AES encryption key from a passphrase?– kelalakaJul 18, 2019 at 14:53
-
2Might be that whoever created it wanted something that could be FIPS 140 certified. PBKDF2 is an approved FIPS 140 algorithm. bcrypt is not.– SwashbucklerJul 18, 2019 at 16:33
|
Show 3 more comments