GPUs for defense - tricky

Need a lot of parallelism (thousands of work-items)
More than nearly-concurrent authentication attempts provide
PBKDF2 and bcrypt lack parallelism
Yet PBKDF2-HMAC-SHA-1 is an excellent choice for GPU implementation if parallelism is added on top of it
scrypt might be reasonable (large p, low memory)
Involves many other trade-offs, challenges, risks
NVIDIA Tesla cards are suitable for servers, but slower for crypto than AMD's (so implement DJB's hash127 with floating-point?)
Lower reliability (than other components), driver bugs
Heat dissipation (use lower clock rate, duty cycle)