Late 1990s: OpenBSD bcrypt "We present two algorithms with adaptable cost -- eksblowfish, a block cipher with a purposefully expensive key schedule, and bcrypt, a related hash function." Niels Provos and David Mazieres, "A Future-Adaptable Password Scheme", The OpenBSD Project, 1999 Configurable iteration count (encoded as base-2 logarithm), 128-bit salt In 2000 and later, adopted by Openwall GNU/*/Linux, ALT Linux, OpenSUSE and made available as a non-default option on other *BSDs and Solaris $2a$08$128bitsalt22charslongOlHvsqGDe2tlXUwNgAVQ82BcG8Q8dWfu 8-to-32 variable S-boxes, so uses 32 bits per machine word only Would need scatter/gather (or at least gather) to overcome that (AVX2 VSIB, Intel MIC)