one weakness of pbkdf2 is that while its number of iterations can be adjusted to make it take an arbitrarily large amount of computing time, it can be implemented with a small circuit and very little ram, which makes brute-force attacks using application-specific integrated circuits or graphics processing units relatively cheap. the bcrypt password hashing function requires a larger amount of ram (but still not tunable separately, i. e. fixed for a given amount of cpu time) and is slightly stronger against such attacks, while the more modern scrypt key derivation function can use arbitrarily large amounts of memory and is therefore more resistant to asic and gpu attacks.