4

Let's assume that, for creating a LUKS volume, I generate a random, 40 character passphrase that includes numbers, symbols, and upper and lower case letters, using the pwgen utility.

Given that the passphrase contains roughly 256 bits of entropy, if I use aes-xts-plain as my cipher, a 512 bit key, and sha512 for the hash, then would it be necessary (worth any reasonable gain) to also use a high iteration count -- say, 1 million, for the sake of example?

user311982
  • 143
  • 2

1 Answers1

6

If you are certain that the passphrase contains enough entropy, then iteration is not needed. The iteration is only required when the entropy is low. The only way to preclude brute force search through a small search space is to make each guess take a prohibitively long amount of time. This is why the iteration count is recommended to be high: To ensure that nobody can guess more then a small number of passwords per second.

If the passphrase contains 256 bits of entropy, then it does not matter how fast the hash can be computed - the search space is simply too large for anyone to search through, regardless of how fast they can look.

Ella Rose
  • 19,971
  • 6
  • 56
  • 103