The KeePass security help page talks about preventing dictionary attacks
To generate the final 256-bit key that is used for the block cipher, KeePass first hashes the user's password using SHA-256, encrypts the result N times using the Advanced Encryption Standard (AES) algorithm (called key transformation rounds from on now), and then hashes it again using SHA-256. For AES, a random 256-bit key is used, which is stored in the database file. As the AES transformations aren't pre-computable (key is random), an attacker has to perform all the encryptions, too, otherwise he cannot try and see if the current key is correct.
The "security against dictionary attacks" apparently lies in the time needed for the N encryption rounds. Now the question:
Is the time needed to compute N iterations of AES really N times the time needed for a single AES encryption, or is there a known, more efficient scheme to compute AES^N(cleartext)?