1854562 - PBKDF2 with SHA-512 has poor performance compared to Chromium

Status: UNCONFIRMED

(Core :: DOM: Web Crypto, enhancement, P4)

Description

[juraj.masiar]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0

Steps to reproduce:

1. using a simple benchmark:
   https://jsfiddle.net/icl7126/593u7eph/14/

Actual results:

Firefox ESR 102:
"PBKDF2 with 10,000,000 iterations and SHA-256 finished in 1601 ms"
"PBKDF2 with 10,000,000 iterations and SHA-512 finished in 9465 ms"

Firefox Nightly 119:
"PBKDF2 with 10,000,000 iterations and SHA-256 finished in 1396 ms"
"PBKDF2 with 10,000,000 iterations and SHA-512 finished in 8054 ms"

Chrome 117:
"PBKDF2 with 10,000,000 iterations and SHA-256 finished in 891 ms"
"PBKDF2 with 10,000,000 iterations and SHA-512 finished in 2987 ms"

Let me try to put it in a table:

Browser	Hash Algorithm	Iterations per Second	Chrome vs. Firefox (%)
Firefox Nightly 119	SHA-256	7,155,274 iterations/s	Chrome is ~57% faster
Firefox Nightly 119	SHA-512	1,241,465 iterations/s	Chrome is ~267% faster
Chrome 117	SHA-256	11,223,345 iterations/s
Chrome 117	SHA-512	3,345,485 iterations/s

Comment 1

[zjc]

+1 👍🏻

Firefox's PBKDF2 performance is terrible, here's a comparison with Chrome and FastPBKDF2:

async function pbkdf2(algo) {
  const pwd = crypto.getRandomValues(new Uint8Array(16))
  const k = await crypto.subtle.importKey('raw', pwd, 'PBKDF2', false, ['deriveBits'])
  console.time(algo)
  const buf = await crypto.subtle.deriveBits({
    iterations: 8388608,
    salt: new Uint8Array(0),
    name: 'PBKDF2',
    hash: algo,
  }, k, 256)
  console.timeEnd(algo)
  console.log(
    algo, [...new Uint8Array(buf)].map(v => v.toString(16)).join(':')
  )
}
pbkdf2('SHA-256')
pbkdf2('SHA-512')

FastPBKDF2:

https://github.com/ctz/fastpbkdf2
cd fastpbkdf2
make
./bench 23

Result (MacBookPro M1):

	SHA256	SHA512
Chrome	820	2900
FireFox	1000	9900
FastPBKDf2	580	1610

PBKDF2 is the only API on the web that allows you to specify a cost. Higher performance means that the password can be iterated more times in the same amount of time, and the cost for attackers to crack it is higher. I hope that Firefox developers will consider using FastPBKDF2 (https://github.com/ctz/fastpbkdf2) to optimize, so that more CPU resources are used for password calculations instead of meaningless overhead.