Are DMG passwords really going through 250,000 rounds of PBKDF2-HMAC-SHA1?
I've been using the Python PBKDF2 module with fewer iterations as it takes over 18 seconds to hash a password with 250,000 iterations on my 2.7 GHz Core i5:
In [1]: import pbkdf2
In [2]: %time pbkdf2.PBKDF2('mypassword', open('/dev/urandom').read(16), 250000).read(32)
CPU times: user 18.36 s, sys: 0.07 s, total: 18.43 s
Wall time: 18.45 s
Out[2]: '<>\x17\x03q+\x1d\x1c+\x94^\xa2\xc9&\xa9\xa56\xc2\xfa\x97A\xd7\xfb\xc8\x93r\x9d\xa0\xd67|\x1e'
Also, everyone else seems to be using way fewer iterations, e.g. 5000 for LastPass (http://helpdesk.lastpass.com/security-options/password-itera...)
I wonder if the C implementation is much faster, or if Apple uses some special hardware acceleration (GPU or special CPU instructions), as I'd love to increase the number of iterations in my Python application.
I've been using the Python PBKDF2 module with fewer iterations as it takes over 18 seconds to hash a password with 250,000 iterations on my 2.7 GHz Core i5:
In [1]: import pbkdf2
In [2]: %time pbkdf2.PBKDF2('mypassword', open('/dev/urandom').read(16), 250000).read(32) CPU times: user 18.36 s, sys: 0.07 s, total: 18.43 s Wall time: 18.45 s Out[2]: '<>\x17\x03q+\x1d\x1c+\x94^\xa2\xc9&\xa9\xa56\xc2\xfa\x97A\xd7\xfb\xc8\x93r\x9d\xa0\xd67|\x1e'
Also, everyone else seems to be using way fewer iterations, e.g. 5000 for LastPass (http://helpdesk.lastpass.com/security-options/password-itera...)
I wonder if the C implementation is much faster, or if Apple uses some special hardware acceleration (GPU or special CPU instructions), as I'd love to increase the number of iterations in my Python application.