3 ms·

Here's a node way of doing it: https://github.com/solomon23/solomon-angular-node-seed/blob/master/server/utils/hash.coffee https://github.com/solomon23/solomon-

• sehrope 12y ago
  From the link: ITERATIONS = 600 ... crypto.pbkdf2 pwd, salt, ITERATIONS, LEN, (err, hash) -> That's way too small for the number of iterations. Something like 100K would be a better choice. Alternatively here's a version that uses bcrypt: bcrypt = require 'bcrypt' rounds = Number(process.env.BCRYPT_ROUNDS || 12) module.exports = hash: (password, cb) -> bcrypt.hash password, rounds, cb compare: (password, hashedPassword, cb) -> bcrypt.compare password, hashedPassword, cb
  • solomone 12y ago
    From my testing 600 took about 15ms. 100k would take about 2.5 seconds.
    • sehrope 12y ago
      For me 600 iterations takes about 3ms (I guess my laptop is a bit faster). A decent range to shoot for is .5-1 sec. Test program: crypto = require 'crypto' password = 'testing' len = 128 salt = crypto.randomBytes(len) iters = Number(process.argv[2] || 600) console.log 'Testing iters=%s', iters for i in [1..10] start = Date.now() crypto.pbkdf2Sync password, salt, iters, len elapsed = Date.now() - start console.log ' Test #%s - %s ms', i, elapsed Output: $ coffee pbkdf2-test.coffee 100000 Testing iters=100000 Test #1 - 497 ms Test #2 - 510 ms Test #3 - 496 ms Test #4 - 525 ms Test #5 - 510 ms Test #6 - 493 ms Test #7 - 521 ms Test #8 - 518 ms Test #9 - 510 ms Test #10 - 498 ms $ coffee pbkdf2-test.coffee 10000 Testing iters=10000 Test #1 - 54 ms Test #2 - 50 ms Test #3 - 50 ms Test #4 - 55 ms Test #5 - 51 ms Test #6 - 52 ms Test #7 - 50 ms Test #8 - 49 ms Test #9 - 51 ms Test #10 - 50 ms $ coffee pbkdf2-test.coffee 600 Testing iters=600 Test #1 - 3 ms Test #2 - 3 ms Test #3 - 3 ms Test #4 - 3 ms Test #5 - 3 ms Test #6 - 4 ms Test #7 - 3 ms Test #8 - 4 ms Test #9 - 3 ms Test #10 - 3 ms
      • solomone 12y ago
        Nice, I was actually testing on my server hardware which is obviously lower end. This is hopefully useful for people though. For me 1 second seems pretty aggressive, that's CPU time/latency per login.