From 2c31968bf384b42c8ec5d9acc8a6521f8acc0dc6 Mon Sep 17 00:00:00 2001
From: yucheng-berri <293926326+yucheng-berri@users.noreply.github.com>
Date: Wed, 14 Oct 2026 22:27:14 -0700
Subject: [PATCH] chore(auth): document the PBKDF2 iteration constants'
 provenance

---
 litellm/proxy/utils.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/litellm/proxy/utils.py b/litellm/proxy/utils.py
index a5b14c6fc6a..6821a87ec89 100644
--- a/litellm/proxy/utils.py
+++ b/litellm/proxy/utils.py
@@ -7156,7 +7156,12 @@ def hash_token(token: str):
     return hashed_token
 
 
+# OWASP Password Storage Cheat Sheet recommendation
+# for PBKDF2-HMAC-SHA256.
 PBKDF2_ITERATIONS: Final = 600_000
+
+# Defensive upper bound against excessive CPU usage from
+# malformed or untrusted stored iteration counts.
 PBKDF2_MAX_ITERATIONS: Final = 10_000_000
 PBKDF2_PREFIX: Final = "pbkdf2:sha256:"
 SCRYPT_PREFIX: Final = "scrypt:"