I am trying to fully understand the relationship between BCRYPT
's COST
factors and how much more time it would take a machine to crack a password with PHP 5.5's password_hash()
The encryption times I observed on an average server for password_hash() are:
COST 14 takes 1.23s to 2s
COST 13 takes 0.6 to 1s
COST 12 takes about 0.3s
COST 11 takes about 0.15s
COST 10 takes about 0.08s
COST 09 takes about 0.04s
Are the number of rounds linearly proportional to the time taken?
Is the computation time required to crack a password on the same linear scale or exponential like?
e.g. If a COST 10 hash took 1 minute to crack. How much time are we looking at with COST 14 for the same password? I assume this would vary depending on the password entropy. So let's take an average fairly weak 10 letter password such as "EasyCrack1" as basis for the reasoning.