3 ms·
If I set bcrypt cost to 11, hashing takes 0.1 seconds. At 12, it takes 1 second roughly. Setting it to anything higher leaves my service open to Denial-of-Servi
by xrstf 12y ago
If I set bcrypt cost to 11, hashing takes 0.1 seconds. At 12, it takes 1 second roughly. Setting it to anything higher leaves my service open to Denial-of-Service attacks, so I'm very hesitant to increase the cost factor.
To you have a credible source for the "10..12 is too low for 2015" claim?
HHVM 3.6 on a small Ubuntu server
- jxcl 12y agoYou have either a very slow server or a very bad bcrypt implementation. Running bcrypt in python on my 5 year old server has these results: >>> timeit.timeit("bcrypt.hashpw('this is a password', bcrypt.gensalt(11))", setup="import bcrypt", number=5) / 5 0.13497538566589357 >>> timeit.timeit("bcrypt.hashpw('this is a password', bcrypt.gensalt(12))", setup="import bcrypt", number=5) / 5 0.28287739753723146 >>> timeit.timeit("bcrypt.hashpw('this is a password', bcrypt.gensalt(13))", setup="import bcrypt", number=5) / 5 0.5341608047485351 >>> timeit.timeit("bcrypt.hashpw('this is a password', bcrypt.gensalt(14))", setup="import bcrypt", number=5) / 5 1.069920015335083 >>> timeit.timeit("bcrypt.hashpw('this is a password', bcrypt.gensalt(15))", setup="import bcrypt", number=5) / 5 2.151028203964233 That's five repetitions of a bcrypt hash with the work factor passed in bcrypt.gensalt(). The resulting units are seconds.
- xrstf 12y agoYou are right, my times are apparently somewhat dated. HHVM 3.6 actually gives me 1.88 seconds with costs of 15. Good thing you made me re-measure :) That makes 13 my new bcrypt default.