Password hashing scheme selection criteria Password hashing schemes and key derivation functions are not all equally good for all use cases Need to be efficient for defenders and inefficient for attackers To the extent practical Efficient on common defenders' hardware Commodity servers, desktops, or/and mobile devices as appropriate for the use case Inefficient on other types of hardware GPUs, typical botnet nodes (vs. defenders' servers), FPGAs, ASICs OK, can't be literally "inefficient" on ASICs, but can minimize the advantage Numerous other aspects matter too