title: About how fast can you brute force PBKDF2?
body: <p>After the linkedin password hash leak, I've been looking at our password hashing. We using Django 1.4 which uses PBKDF2, which is great and a step up from the previous SHA1.</p>
  
  <p>However I'm curious how easily one could brute force that. I'm looking at our password complexity rules, and am wondering how fast it'd take to do (say) 8 length lower case ascii letters.</p>
  
  <p>This guide to cracking the LinkedIn password hash, has someone doing 430 million sha1 hashes per second on a GPU. <a href="http://erratasec.blogspot.ie/2012/06/linkedin-vs-password-cracking.html" rel="noreferrer">http://erratasec.blogspot.ie/2012/06/linkedin-vs-password-cracking.html</a> What kinda speeds would you get for PBKDF2?</p>
  
  <p>Does anyone have any rough/back-of-the-envelope/ballpark figures for how fast one could brute force PBKDF2?</p>