4 ms·

From the link: ITERATIONS = 600 ... crypto.pbkdf2 pwd, salt, ITERATIONS, LEN, (err, hash) -> That's way too small for the number of iterations. So

by sehrope 12y ago

From the link: ITERATIONS = 600 ... crypto.pbkdf2 pwd, salt, ITERATIONS, LEN, (err, hash) -> That's way too small for the number of iterations. Something like 100K would be a better choice. Alternatively here's a version that uses bcrypt: bcrypt = require 'bcrypt' rounds = Number(process.env.BCRYPT_ROUNDS || 12) module.exports = hash: (password, cb) -> bcrypt.hash password, rounds, cb compare: (password, hashedPassword, cb) -> bcrypt.compare password, hashedPassword, cb

solomone 12y ago
From my testing 600 took about 15ms. 100k would take about 2.5 seconds.
- sehrope 12y ago
  For me 600 iterations takes about 3ms (I guess my laptop is a bit faster). A decent range to shoot for is .5-1 sec. Test program: crypto = require 'crypto' password = 'testing' len = 128 salt = crypto.randomBytes(len) iters = Number(process.argv[2] || 600) console.log 'Testing iters=%s', iters for i in [1..10] start = Date.now() crypto.pbkdf2Sync password, salt, iters, len elapsed = Date.now() - start console.log ' Test #%s - %s ms', i, elapsed Output: $ coffee pbkdf2-test.coffee 100000 Testing iters=100000 Test #1 - 497 ms Test #2 - 510 ms Test #3 - 496 ms Test #4 - 525 ms Test #5 - 510 ms Test #6 - 493 ms Test #7 - 521 ms Test #8 - 518 ms Test #9 - 510 ms Test #10 - 498 ms $ coffee pbkdf2-test.coffee 10000 Testing iters=10000 Test #1 - 54 ms Test #2 - 50 ms Test #3 - 50 ms Test #4 - 55 ms Test #5 - 51 ms Test #6 - 52 ms Test #7 - 50 ms Test #8 - 49 ms Test #9 - 51 ms Test #10 - 50 ms $ coffee pbkdf2-test.coffee 600 Testing iters=600 Test #1 - 3 ms Test #2 - 3 ms Test #3 - 3 ms Test #4 - 3 ms Test #5 - 3 ms Test #6 - 4 ms Test #7 - 3 ms Test #8 - 4 ms Test #9 - 3 ms Test #10 - 3 ms
  - solomone 12y ago
    Nice, I was actually testing on my server hardware which is obviously lower end. This is hopefully useful for people though. For me 1 second seems pretty aggressive, that's CPU time/latency per login.

by sehrope 12y ago

solomone 12y ago

From my testing 600 took about 15ms. 100k would take about 2.5 seconds.

sehrope 12y ago
For me 600 iterations takes about 3ms (I guess my laptop is a bit faster). A decent range to shoot for is .5-1 sec. Test program: crypto = require 'crypto' password = 'testing' len = 128 salt = crypto.randomBytes(len) iters = Number(process.argv[2] || 600) console.log 'Testing iters=%s', iters for i in [1..10] start = Date.now() crypto.pbkdf2Sync password, salt, iters, len elapsed = Date.now() - start console.log ' Test #%s - %s ms', i, elapsed Output: $ coffee pbkdf2-test.coffee 100000 Testing iters=100000 Test #1 - 497 ms Test #2 - 510 ms Test #3 - 496 ms Test #4 - 525 ms Test #5 - 510 ms Test #6 - 493 ms Test #7 - 521 ms Test #8 - 518 ms Test #9 - 510 ms Test #10 - 498 ms $ coffee pbkdf2-test.coffee 10000 Testing iters=10000 Test #1 - 54 ms Test #2 - 50 ms Test #3 - 50 ms Test #4 - 55 ms Test #5 - 51 ms Test #6 - 52 ms Test #7 - 50 ms Test #8 - 49 ms Test #9 - 51 ms Test #10 - 50 ms $ coffee pbkdf2-test.coffee 600 Testing iters=600 Test #1 - 3 ms Test #2 - 3 ms Test #3 - 3 ms Test #4 - 3 ms Test #5 - 3 ms Test #6 - 4 ms Test #7 - 3 ms Test #8 - 4 ms Test #9 - 3 ms Test #10 - 3 ms
- solomone 12y ago
  Nice, I was actually testing on my server hardware which is obviously lower end. This is hopefully useful for people though. For me 1 second seems pretty aggressive, that's CPU time/latency per login.