Hacker News Reader

Comment by minitech | Hacker News Reader

> 10M iterations took 8 minutes for a single hash.

  ~: time node -p 'crypto.pbkdf2Sync("password", "salt", 10e6, 32, "sha256").toString("hex")'
  3c0873fa17659d22450cfcc4a7dd8e51e66db276a0d594cc729baba5af5cedd8
  node -p   6.55s user 0.02s system 99% cpu 6.576 total

10 million iterations in 6.5 seconds on a cheap laptop. Not sure what caused your numbers, but spending a few seconds on a password hash is not “idiocy”.

View on HN

Maybe it was a javascript implementation?

It was a java library, not sure if the implementation was in C.

Either the library you were using was terrible, your servers were powered by hamsters, or you were feeding the wrong parameters into the algorithm.

The code below takes ~15 seconds on 1 year old MacBook running Java 1.8.0_111-b14 and uses no 3rd party libraries:

        PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 10_000_000, 256);
        SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");     
        byte[] hash = skf.generateSecret(spec).getEncoded();

It was some years ago on first or second gen Xeon. Wouldn't be surprised if your new CPU is twice as fast.

There is a vulnerability in PBKDF2 that halved the amount of operations. New libraries make use of it but it wasn't known at the time.

That 15+ seconds would be 1+ minute back then. Assume the first implementations were poorly optimized and that's multiple minutes.

Reply on news.ycombinator.com