+ * 5.10 Some people say PBKDF2 is insecure?
+
+ There is some discussion that a hash-function should have a "large
+ memory" property, i.e. that it should require a lot of memory to be
+ computed. This serves to prevent attacks using special programmable
+ circuits, like FPGAs, and attacks using graphics cards. PBKDF2
+ does not need a lot of memory and is vulnerable to these attacks.
+ However, the publication usually refered in these discussions is
+ not very convincing in proving that the presented hash really is
+ "large memory" (that may change, email the FAQ maintainer when it
+ does) and it is of limited usefulness anyways. Attackers that use
+ clusters of normal PCs will not be affected at all by a "large
+ memory" property. For example the US Secret Service is known to
+ use the off-hour time of all the office PCs of the Treasury for
+ password breaking. The Treasury has about 110'000 employees.
+ Asuming every one has an office PC, that is significant computing
+ power, all of it with plenty of memory for computing "large
+ memory" hashes. Bot-net operators also have all the memory they
+ want. The only protection against a resouceful attacker is a
+ high-entropy passphrase, see items 5.8 and 5.9.
+
+
+ * 5.11 What about iteration count with plain dm-crypt?