Desirable properties of a future KDF These need to be configurable With settings encoded along with password hashes, etc. - depending on specific use case Lots of parallelism within one instance Ability to use almost arbitrarily wide SIMD vectors within one instance Existing hashes upgradable to higher iteration counts without knowledge of the plaintext passwords Maybe to higher memory cost and higher available parallelism as well? - tricky Friendly to whatever hardware we have in the defender's system and to hardware that we might have there in the foreseeable future Optionally unfriendly to other kinds of hardware