Improve performance using Bcrypt in VertX

Question

I'm creating a register method in vertx which use Bcrypt to encode password in database. My problem came from the slow performance in encoding password using BCrypt.

When im using :
- Bcrypt my query take around ~1200ms
- Whitout Bcrypt ~220ms

So what can i do to improve performance ? Is there antoher way to encode password in VertX ?

i'm using Bcrypt (http://www.mindrot.org/projects/jBCrypt/) in vertx.

Answer 1

As you stated: that's not a Vert.x issue/problem. The BCrypt algorithm takes an X amount of time to encode/encrypt a given value — and it's slow on purpose.

I guess you can leverage on the Vert.x capabilities and have N instances of "worker verticles" doing the encryption work. Again, the time "won't shrink", but you will have "some dedicated guys" just for doing that — you can always tweak the number of instances to your needs. Maybe that's too much, but I'm just throwing it in case you haven't thought about it.

Moreover, I think using BCrypt is (one of) the way(s) to go; it's a one time operation and later on "checking" a given value it is not-so-time-consuming. Additionally, it will give you a better/strong security compared to other (hashing included) algorithms if you use the proper salt size, jadda, jadda.

Answer 2

Honestly, that is probably the best way. BCrypt does a better hash encoding. The faster algorithms aren't nearly as good and certainly don't future proof whatever system you are making. But yes, you can use MD5 and it'll go much faster.

Answer 3

Note that BCrypt is slow on purpose (see e.g. here: Bcrypt for password hashing because it is slow?) so it is not a "bug" but a feature.

(as mentioned in the link, the slowness adds to extra security - it is slower to brute-force the password)

So you really should think twice before wanting the BCrypt password encryption to be fast.