You can compensate for not just 50x but 500x by adding 2 characters to your password. If that's the speedup factor, it's not itself a big worry.

▲

tptacek 4 hours ago | parent [-]

You can eliminate the problem entirely by using a random full-allowed-character-set password. The whole point of KDFs is that the password/passphrase is predictable (usually: by being generated from a seed dictionary).

▲

Dylan16807 4 hours ago | parent [-]

Random is important, character set not so much. And yes when I say 2 characters I mean random ones. Even 26x26 is plenty to compensate. Or you can add one random word.

▲

tptacek 4 hours ago | parent [-]

We're both saying the same thing: you can make the KDF irrelevant if you (as you just specified) use an AES key as an input. The entire point of KDF is that humans don't do that.

	▲	Dylan16807 3 hours ago \| parent [-]
		No, what I'm saying is: If your password was good enough for a quality KDF, then improving it to use a 50x worse KDF is very easy. If the worse one requires you "use an AES key", then the good one pretty much also required you to "use an AES key". If the good one didn't require that, then the 50x worse one also doesn't require that. Generate a single letter and slap it on the end, or human-pick two letters. 50x is not the decider between allowing a good password and allowing a bad password. It's a tiny little nudge. Edit: To put "little nudge" another way, if you have a 1-10 scale of password quality, most steps in that scale are going to be more than 5.6 bits apart.