Inspired by this question about the difficulty of cracking a KeePass database, I'm wondering if changing the default number of iterations in an encryption application (e.g., KeePass) increases security. I'm hoping the question is applicable to a variety of applications; if not, I guess today I'm curious about KeePass.
My reasoning is that an attacker doesn't know the number of iterations ahead of time and therefore has two options:
- Assume the user of the encryption application didn't bother to change the default number of iterations, or
- Check for password validity for a range of thousands of possible iteration choices (the default is 6,000, so maybe anything from 5,000 to 20,000 or more)
Because #2 is much more work, it's a safer bet for the user to change the default. My theory would be that using a number like 6,001 actually substantially increases security since the attacker is going to focus efforts on the default value of 6,000.
I've read some related questions, which discuss generally how many iterations to choose. What isn't clear to me is whether using an application such as KeePass, where the default number is known to the attacker, makes it important to change the default. If my hunch is wrong, you'll tell me that using 6,001 iterations in KeePass is just as secure as 6,000.