The iteration count here is only 1000. But the current standard is 600,000.
You can see it from Wiki:
“When the standard was written in the year 2000 the recommended minimum number of iterations was 1,000, but the parameter is intended to be increased over time as CPU speeds increase. A Kerberos standard in 2005 recommended 4,096 iterations; Apple reportedly used 2,000 for iOS 3, and 10,000 for iOS 4; while LastPass in 2011 used 5,000 iterations for JavaScript clients and 100,000 iterations for server-side hashing. In 2023, OWASP recommended to use 600,000 iterations for PBKDF2-HMAC-SHA256 and 210,000 for PBKDF2-HMAC-SHA512.”
This is an internal script used to build the software it wouldn’t be used on any Pritunl server. The script has been used for a long time and it’s unlikely it will be changed. The build system now is far more secure and these keys are no longer stored outside of the build system. There is less of a need to have the keys encrypted with the newer build system.
The passwords in the software are encrypted with HMAC-SHA512 100k iterations. This won’t provide much protection for the system overall. The certificate authority will need to be stored in the database and these keys would be more significant if the database were compromised. To have a secure system device authentication should be used for VPN users and YubiKeys for administrators. This will ensure the system is secure even if the keys were extracted from the database. The high security enviroment documentation has information on the recommended security configuration.