Yes, definitely you are right.

And at the same time using various other methods "depending on the master key" makes it impossible for an accurate time and process estimation for brute-force attacks.