4 ms·
Either the library you were using was terrible, your servers were powered by hamsters, or you were feeding the wrong parameters into the algorithm. The code be
by timv 9y ago
Either the library you were using was terrible, your servers were powered by hamsters, or you were feeding the wrong parameters into the algorithm.
The code below takes ~15 seconds on 1 year old MacBook running Java 1.8.0_111-b14 and uses no 3rd party libraries:
PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 10_000_000, 256);
SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
byte[] hash = skf.generateSecret(spec).getEncoded();
- user5994461 9y agoIt was some years ago on first or second gen Xeon. Wouldn't be surprised if your new CPU is twice as fast. There is a vulnerability in PBKDF2 that halved the amount of operations. New libraries make use of it but it wasn't known at the time. That 15+ seconds would be 1+ minute back then. Assume the first implementations were poorly optimized and that's multiple minutes.