OPC UA password hashing best practices

[rth]

Hello,

I was wondering if anyone could share some best practices for password hashing when writing an OPCUA server (with authentication and encryption enabled) to prevent brute force attacks.

For instance, if I use bcrypt with default parameters, it takes around 200ms on my machine to compare the user provided password against the valid hash. Meaning OPCUA clients would take at least that time to establish a connection, which may be somewhat a lot in the context of real time system. Or is this OK in your opinion?