Hacker News Reader

Comment by user5994461 | Hacker News Reader

It was a java library, not sure if the implementation was in C.

Either the library you were using was terrible, your servers were powered by hamsters, or you were feeding the wrong parameters into the algorithm.

The code below takes ~15 seconds on 1 year old MacBook running Java 1.8.0_111-b14 and uses no 3rd party libraries:

        PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 10_000_000, 256);
        SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");     
        byte[] hash = skf.generateSecret(spec).getEncoded();

It was some years ago on first or second gen Xeon. Wouldn't be surprised if your new CPU is twice as fast.

There is a vulnerability in PBKDF2 that halved the amount of operations. New libraries make use of it but it wasn't known at the time.

That 15+ seconds would be 1+ minute back then. Assume the first implementations were poorly optimized and that's multiple minutes.

Reply on news.ycombinator.com