Desirable properties of a future KDF These need to be configurable With settings encoded along with password hashes, etc. - depending on specific use case Tunable high-level and instruction-level parallelism within one instance Barely sufficient if the KDF is sequential memory-hard, otherwise abundant will do Ability to use almost arbitrarily wide SIMD vectors within one instance Running time almost independent of password length Existing hashes upgradable to higher iteration counts without knowledge of the plaintext passwords Maybe to higher memory cost and higher available parallelism as well? - tricky Friendly to whatever hardware we have in the defender's system and to hardware that we might have there in the foreseeable future