Dan Guido

@msolnik @dguido “The iteration count is calibrated so that one attempt takes approximately 80 milliseconds” https://www.apple.com/business/docs/iOS_Security_Guide.pdf …

@msolnik @dguido the key for pbkdf2 is in the enclave, there’s no key read API, so I’m 99.999% sure it’s pure hardware cost of 80ms.

@nzkoz @msolnik software can't lower the iteration count. Once you derive the key from a passcode, that's it, you have to deal.

@dguido @msolnik could lower the iteration count for future passcodes set on the device. But ya doesn’t help here, just future brute forcers

@nzkoz @msolnik correct, but that's not the scenario we're talking about.