5 ms·
> 10M iterations took 8 minutes for a single hash. ~: time node -p 'crypto.pbkdf2Sync("password", "salt", 10e6, 32, "sha256").toString("hex")' 3c0873fa1765
by minitech 9y ago
> 10M iterations took 8 minutes for a single hash.
~: time node -p 'crypto.pbkdf2Sync("password", "salt", 10e6, 32, "sha256").toString("hex")'
3c0873fa17659d22450cfcc4a7dd8e51e66db276a0d594cc729baba5af5cedd8
node -p 6.55s user 0.02s system 99% cpu 6.576 total
10 million iterations in 6.5 seconds on a cheap laptop. Not sure what caused your numbers, but spending a few seconds on a password hash is not “idiocy”.
- rocqua 9y agoMaybe it was a javascript implementation?
- user5994461 9y agoIt was a java library, not sure if the implementation was in C.
- timv 9y agoEither the library you were using was terrible, your servers were powered by hamsters, or you were feeding the wrong parameters into the algorithm. The code below takes ~15 seconds on 1 year old MacBook running Java 1.8.0_111-b14 and uses no 3rd party libraries: PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 10_000_000, 256); SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256"); byte[] hash = skf.generateSecret(spec).getEncoded();
- user5994461 9y agoIt was some years ago on first or second gen Xeon. Wouldn't be surprised if your new CPU is twice as fast. There is a vulnerability in PBKDF2 that halved the amount of operations. New libraries make use of it but it wasn't known at the time. That 15+ seconds would be 1+ minute back then. Assume the first implementations were poorly optimized and that's multiple minutes.