I'm new to computer security, there's one question I got confused. The book "Security in Computing" describe that "To protect the master password, the client uses a form of PBKDF2, salting the master password with random data and hashing it by using a large number (5001 by default) of SHA-256 rounds." for user authentication. and it described "The client derives the decryption key from the master password just as it did the login hash, but using one fewer SHA-256 round (5000 rounds instead of 5001)." for database decryption. I wonder if we can change make the opposite. In particular, use 5001 rounds for decryption, but use 5000 rounds for authentication.
Hope someone can help me here, thank you!