//Number of default iterations. Somewhere between 50k and 500k is good to test const int DefaultIterations = 100000; const int NumBytes = 32; //Initialize Generator var Gen = new System.Security.Cryptography.Rfc2898DeriveBytes("SomePassword", 16, DefaultIterations); //Measure Time var DT = DateTime.UtcNow; Gen.GetBytes(NumBytes); var Runtime = DateTime.UtcNow.Subtract(DT).TotalMilliseconds; //Calculate iterations for 1 second duration and round it to thousands. var ProposedIterations = (int)(DefaultIterations / Runtime) * 1000; //Write Statistics Console.WriteLine("Initial Measurement:"); Console.WriteLine("Time (msec): {0}", (int)Runtime); Console.WriteLine("Iterations: {0}", DefaultIterations); Console.WriteLine("Proposed for 1 sec: {0}", ProposedIterations); //Verify proposed iterations by doing it again Console.WriteLine("Verifying..."); //Reinitialize Generator with proposed value for iterations Gen = new System.Security.Cryptography.Rfc2898DeriveBytes("SomePassword", 16, ProposedIterations); DT = DateTime.UtcNow; Gen.GetBytes(NumBytes); Runtime = DateTime.UtcNow.Subtract(DT).TotalMilliseconds; //Write new Statistics Console.WriteLine("Time (msec): {0}", (int)Runtime); Console.WriteLine("Iterations: {0}", ProposedIterations); Console.WriteLine("Proposed for 1 sec: {0}", (int)(ProposedIterations / Runtime) * 1000 /*round to 1000*/); //If everything went alright, //the new proposed value should almost match the first proposed value (5000 diff max).