In the browser, I'm using AES-256-CBC with 128bit IV & PBKDF2 to encrypt the mnemonic

"tell file snow green proof evil six squeeze budget various orbit clock" 

with a password


with 30,000 rounds it's taking roughly 22 seconds. It feels too long, but I don't want to make it insecure.

Can I safely reduce the rounds to make it a bit faster? and if so what would be the minimum?

Could I get away with 10,000?

  • Why do you need multiple rounds of AES? Is this some form of key strengthening? Also 1400 rounds of AES is extremely slow, what software are you using? Apr 17 '17 at 11:01
  • This is just with JavaScript in the browser, the reason for the multiple rounds is to slow down a brute force attack and the use of PBKDF2 is to strengthen the password. Apr 17 '17 at 11:13
  • But the 30000 rounds is for PBDKF, not for AES, I assume? Apr 17 '17 at 12:44
  • yes we are passing in the password, iv, rounds and key size to PBKDF2, sorry if I wasn't clear Apr 17 '17 at 12:56
  • 1
    I'm editing the title. Apr 17 '17 at 13:12

Can I safely reduce the rounds to make it a bit faster? and if so what would be the minimum?

Could I get away with 10,000?

Anyone trying to crack your encrypted data is not going to be limited by the speed of javascript executing in a browser. They'll be running FPGAs or something much faster than that. So 20,000, 10,000 or 0 doesn't make any sort of difference here.

Where I learned this

  • So your saying PBKDF2 is a waste of time and I shouldn't even bother? Should I be looking at Scrypt or Bcrypt? Apr 19 '17 at 0:51
  • That's not what i mean at all. I mean a low number of key stretching rounds isn't worth anything. You can't get a high number because javascript is slower than C compiled code and much slower than FPGAs. If you see that link G Maxwell talks about how Core does 200,000 rounds using just one CPU core. That's possible because its coded in C++.
    – Abdussamad
    Apr 19 '17 at 4:21
  • So your saying 10-20,000 rounds in a browser isn't worth doing. As I'm stuck in the browser for this project, I guess I shouldn't bother with PBKDF2 or should I approach this problem differently? Apr 19 '17 at 4:39
  • Maybe AES-256-CBC is enough? if it is enough why is PBKDF2 thrown into the mix? Apr 19 '17 at 4:58
  • a key derivation function is used to derive a random number from a password. you run a kdf multiple times in order to make it harder for someone else to try and bruteforce your password. AES is an encryption algorithm. You use the output of the KDF to encrypt your file using AES. that's how the two fit in. My suggestion is to leave it at the default settings or if that is too slwo then lower the number of rounds. The most important thing you can do is just use a good password. Everything else is fluff.
    – Abdussamad
    Apr 19 '17 at 21:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.