Comment by bityard

> but also allowing an attacker to run an offline decryption attack with unlimited attempts. This invariably leads to your main password getting compromised.

Do the OpenSSH authors not know about PKBDF2 or similar?