TrueCrypt Security Assessment [pdf]
The iteration count used by TrueCrypt [in its PBKDF2 key derivation] is either 1000 or 2000, depending on the hash function and use case. In both cases, this iteration count is too small to prevent password guessing attacks for even moderately complex passwords.Until TrueCrypt gets patched to use scrypt for key derivation, roughly how long should a volume password be to put it out of reach?Edit: There's a table in the scrypt paper from 2002 [1] that estimates the cost of various brute force attacks. Back then, a PBKDF2 iteration count of 86,000 and a password of length 40 would cost $200K to crack. TrueCrypt's choice of 1000-2000 iterations look staggeringly low in comparison. And that's not even accounting for hardware advances in the last 12 years.[1] page 14, http://www.tarsnap.com/scrypt/scrypt.pdf