Technology (NIST) recommends a minimum iteration count of 10,000. "For especially critical keys, or for very powerful systems or systems where user-perceived performance is not critical, an iteration count of 10,000,000 may be appropriate.” In 2009, a memory-intensive key strengthening algorithm, scrypt, was introduced with the intention of limiting the use of custom, highly parallel hardware to speed up key testing. In 2013, a Password Hashing Competition was held to select an improved key stretching standard that would resist attacks from graphics processors and special purpose hardware. The winner, Argon2, was selected on July 1, 2015. Some systems that use key stretching Some but not all disk encryption software (see comparison of disk encryption software): 7-Zip Apache .htpasswd "APR1" and OpenSSL "passwd" use 1000 rounds of MD5 key stretching. KeePass and KeePassXC, open-source password manager utilities. As of 2020, the latest version uses Argon2d with default 1 second key stretching delay. Linux and some other Unix-like systems offer SHAcrypt modes that perform 5000 SHA256 or SHA512 hash iterations by default, with a minimum of 1000, and a maximum of 999,999,999. Password Safe open-source password manager. PGP, GPG encryption software. GPG by default iterates a hash 65536 times. Wi-Fi Protected Access (WPA and WPA2) wireless encryption protocol in personal mode used PBKDF2 with 4096 iterations. (WPA3 uses Simultaneous Authentication of Equals which claims to not expose password hashes.) See also Key derivation function – often uses key stretching PBKDF2, bcrypt, scrypt, Argon2 – widely used key stretching algorithms Hash chain References Key management