pbkdf2: use 220,000 iterations for PBKDF2-HMAC-SHA512 per OWASP

pbkdf2/benches/lib.rs

@@ -42,15 +42,15 @@ pub fn pbkdf2_hmac_sha512_16384_20(bh: &mut Bencher) {
     });
 }
 
-/// Benchmark PBKDF2-HMAC-SHA512 with 210,000 rounds. This is the recommended configuration for PBKDF2-HMAC-SHA512 according to the OWASP cheat sheet:
+/// Benchmark PBKDF2-HMAC-SHA512 with 220,000 rounds. This is the recommended configuration for PBKDF2-HMAC-SHA512 according to the OWASP cheat sheet:
 /// <https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2>
 #[bench]
-pub fn pbkdf2_hmac_sha512_210000_20(bh: &mut Bencher) {
+pub fn pbkdf2_hmac_sha512_220000_20(bh: &mut Bencher) {
     let password = b"my secure password";
     let salt = b"salty salt";
     let mut buf = [0u8; 20];
     bh.iter(|| {
-        pbkdf2::<Hmac<sha2::Sha512>>(password, salt, 210_000, &mut buf).unwrap();
+        pbkdf2::<Hmac<sha2::Sha512>>(password, salt, 220_000, &mut buf).unwrap();
         test::black_box(&buf);
     });
 }

pbkdf2/src/params.rs

@@ -48,11 +48,10 @@ impl Params {
     ///
     /// This number is adopted from the [OWASP cheat sheet]:
     ///
-    /// > Use PBKDF2 with a work factor of 210,000 or more and set with an
-    /// > internal hash function of HMAC-SHA-512.
+    /// > PBKDF2-HMAC-SHA512: 220,000 iterations
     ///
     /// [OWASP cheat sheet]: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
-    pub const RECOMMENDED_SHA512_ROUNDS: u32 = 210_000;
+    pub const RECOMMENDED_SHA512_ROUNDS: u32 = 220_000;
 
     /// Recommended PBKDF2 parameters adapted from the [OWASP cheat sheet].
     ///

pbkdf2/tests/pbkdf2.rs

@@ -132,7 +132,7 @@ fn pbkdf2_sha_512_default_iterations() {
     let hash: PasswordHash = Pbkdf2::SHA512
         .hash_password_with_salt(b"pass\0word", b"testsalt")
         .unwrap();
-    assert_eq!(Params::try_from(&hash).unwrap().rounds(), 210_000);
+    assert_eq!(Params::try_from(&hash).unwrap().rounds(), 220_000);
 }
 
 #[test]