CLIENT_KDF_ITER_DEFAULT = 5000? #399

New Issue

2025-11-07T06:35:03-06:00

GiteaMirror commented

2025-11-07 06:35:03 -06:00

Originally created by @Ayitaka on GitHub (Sep 5, 2019).

In src/db/models/user.rs I noticed the default client KDF iterations is 5000:

pub const CLIENT_KDF_ITER_DEFAULT: i32 = 5_000;

Was wondering if there was a reason its set so low by default, and if it shouldn't be 100,000 like Bitwarden now uses for their default? Or possibly a configurable option like how PASSWORD_ITERATIONS is for the server?

Also note the default is set to 5000 in the migration scripts as well:
migrations/mysql/2018-09-19-144557_add_kdf_columns/up.sql
migrations/sqlite/2018-09-19-144557_add_kdf_columns/up.sql

Thanks :)

Originally created by @Ayitaka on GitHub (Sep 5, 2019). In [src/db/models/user.rs](https://github.com/dani-garcia/bitwarden_rs/blob/1322b876e9113cc265e5a2b30f990c0d8ede716e/src/db/models/user.rs) I noticed the default client KDF iterations is 5000: ` pub const CLIENT_KDF_ITER_DEFAULT: i32 = 5_000;` Was wondering if there was a reason its set so low by default, and if it shouldn't be 100,000 like [Bitwarden](https://help.bitwarden.com/article/what-encryption-is-used/) now uses for their default? Or possibly a configurable option like how PASSWORD_ITERATIONS is for the server? Also note the default is set to 5000 in the migration scripts as well: [migrations/mysql/2018-09-19-144557_add_kdf_columns/up.sql](https://github.com/dani-garcia/bitwarden_rs/blob/1322b876e9113cc265e5a2b30f990c0d8ede716e/migrations/mysql/2018-09-19-144557_add_kdf_columns/up.sql) [migrations/sqlite/2018-09-19-144557_add_kdf_columns/up.sql](https://github.com/dani-garcia/bitwarden_rs/blob/1322b876e9113cc265e5a2b30f990c0d8ede716e/migrations/sqlite/2018-09-19-144557_add_kdf_columns/up.sql) Thanks :)

GiteaMirror closed this issue

2025-11-07 06:35:03 -06:00

GiteaMirror commented

2025-11-07 06:35:03 -06:00

@dani-garcia commented on GitHub (Sep 5, 2019):

Well at some point Bitwarden also used 5000 on the client and that's what I based the number on.

The default isn't really used anyway, as when you register an account, a kdfIterations is sent, which is set to 100000, and we use that value.

That said I'll change that default, to better reflect reality.

@dani-garcia commented on GitHub (Sep 5, 2019): Well at some point Bitwarden also used 5000 on the client and that's what I based the number on. The default isn't really used anyway, as when you register an account, a kdfIterations is sent, which is set to 100000, and we use that value. ![image](https://user-images.githubusercontent.com/725423/64365531-a2288a80-d014-11e9-98a8-bb5ded5a73e5.png) That said I'll change that default, to better reflect reality.

GiteaMirror commented

2025-11-07 06:35:04 -06:00

@Ayitaka commented on GitHub (Sep 5, 2019):

Ahhh, I wondered about that. And no sense adding a setting since its overridden anyway. Good to know, thank you very much for clarifying!

closed

@Ayitaka commented on GitHub (Sep 5, 2019): Ahhh, I wondered about that. And no sense adding a setting since its overridden anyway. Good to know, thank you very much for clarifying! *closed*

GiteaMirror commented

2025-11-07 06:35:04 -06:00

@timaschew commented on GitHub (Dec 20, 2019):

This explains why I have this schema:
client_kdf_type INTEGER NOT NULL DEFAULT 0, client_kdf_iter INTEGER NOT NULL DEFAULT 5000)
But when I check the latest migration scripts the it (client_kdf_iter) has become 100000.

But when looking into my rows, the value is always 100000, so i can confirm it got overridden.

@timaschew commented on GitHub (Dec 20, 2019): This explains why I have this schema: ```client_kdf_type INTEGER NOT NULL DEFAULT 0, client_kdf_iter INTEGER NOT NULL DEFAULT 5000)``` But when I check the latest migration scripts the it (client_kdf_iter) has become **100000**. But when looking into my rows, the value is always **100000**, so i can confirm it got overridden.