{"action":"created","issue":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/812","repository_url":"https://api.github.com/repos/thephpleague/oauth2-server","labels_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/812/labels{/name}","comments_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/812/comments","events_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/812/events","html_url":"https://github.com/thephpleague/oauth2-server/issues/812","id":274620212,"number":812,"title":"Encrypting/decrypting very slow due to use of de-/encryptWithPassword()","user":{"login":"SunMar","id":8324268,"avatar_url":"https://avatars0.githubusercontent.com/u/8324268?v=4","gravatar_id":"","url":"https://api.github.com/users/SunMar","html_url":"https://github.com/SunMar","followers_url":"https://api.github.com/users/SunMar/followers","following_url":"https://api.github.com/users/SunMar/following{/other_user}","gists_url":"https://api.github.com/users/SunMar/gists{/gist_id}","starred_url":"https://api.github.com/users/SunMar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SunMar/subscriptions","organizations_url":"https://api.github.com/users/SunMar/orgs","repos_url":"https://api.github.com/users/SunMar/repos","events_url":"https://api.github.com/users/SunMar/events{/privacy}","received_events_url":"https://api.github.com/users/SunMar/received_events","type":"User","site_admin":false},"labels":[{"id":362865558,"url":"https://api.github.com/repos/thephpleague/oauth2-server/labels/Improvement%20Idea","name":"Improvement Idea","color":"f9d0c4","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-11-16T18:39:03Z","updated_at":"2017-11-16T21:19:37Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\nDuring tests we discovered that encrypting and decrypting is very slow. This is caused by the use of the [PBKDF2 algorithm](https://github.com/defuse/php-encryption/blob/5176f5abb38d3ea8a6e3ac6cd3bbb54d8185a689/src/KeyOrPassword.php#L83) in [`KeyOrPassword`](https://github.com/defuse/php-encryption/blob/5176f5abb38d3ea8a6e3ac6cd3bbb54d8185a689/src/KeyOrPassword.php#L7) (from the [`defuse/php-encryption`](https://github.com/defuse/php-encryption) dependency), which can be traced back to [`CryptTrait`](https://github.com/thephpleague/oauth2-server/blob/925776958fc3f5278e74363663c20147af32b668/src/CryptTrait.php#L14) where the [`encryptWithPassword()`](https://github.com/thephpleague/oauth2-server/blob/925776958fc3f5278e74363663c20147af32b668/src/CryptTrait.php#L32) and [`decryptWithPassword()`](https://github.com/thephpleague/oauth2-server/blob/925776958fc3f5278e74363663c20147af32b668/src/CryptTrait.php#L49) methods are used. The use of this algorithm is secure if you're unsure about how good your encryption key is, however if you know you have a secure encryption key, then PBKDF2 is not needed.\r\n\r\nAn easy way to get a big performance boost here is by allowing a [`Key`](https://github.com/defuse/php-encryption/blob/5176f5abb38d3ea8a6e3ac6cd3bbb54d8185a689/src/Key.php#L7) object to be used as encryption key instead of a string. If it's a [`Key`](https://github.com/defuse/php-encryption/blob/5176f5abb38d3ea8a6e3ac6cd3bbb54d8185a689/src/Key.php#L7) object then [`encrypt()`](https://github.com/defuse/php-encryption/blob/5176f5abb38d3ea8a6e3ac6cd3bbb54d8185a689/src/Crypto.php#L20) instead of [`encryptWithPassword()`](https://github.com/defuse/php-encryption/blob/5176f5abb38d3ea8a6e3ac6cd3bbb54d8185a689/src/Crypto.php#L41) and [`decrypt()`](https://github.com/defuse/php-encryption/blob/5176f5abb38d3ea8a6e3ac6cd3bbb54d8185a689/src/Crypto.php#L62) instead of [`decryptWithPassword()`](https://github.com/defuse/php-encryption/blob/5176f5abb38d3ea8a6e3ac6cd3bbb54d8185a689/src/Crypto.php#L84) can be used. With a [`Key`](https://github.com/defuse/php-encryption/blob/5176f5abb38d3ea8a6e3ac6cd3bbb54d8185a689/src/Key.php#L7) the encryption library trusts the key and skips PBKDF2 using only the much faster [HKDF algorithm](https://github.com/defuse/php-encryption/blob/893217037f3ec62c542738189a8b90169275034a/src/KeyOrPassword.php#L64).\r\n\r\nThis could be implemented backwards compatible by checking in `CryptTrait` if `$this->encryptionKey` is an instance of `Key` or not. I can see to make a pull request for this but would first like to know if something like this would be accepted."},"comment":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/comments/345065985","html_url":"https://github.com/thephpleague/oauth2-server/issues/812#issuecomment-345065985","issue_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/812","id":345065985,"user":{"login":"SunMar","id":8324268,"avatar_url":"https://avatars0.githubusercontent.com/u/8324268?v=4","gravatar_id":"","url":"https://api.github.com/users/SunMar","html_url":"https://github.com/SunMar","followers_url":"https://api.github.com/users/SunMar/followers","following_url":"https://api.github.com/users/SunMar/following{/other_user}","gists_url":"https://api.github.com/users/SunMar/gists{/gist_id}","starred_url":"https://api.github.com/users/SunMar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SunMar/subscriptions","organizations_url":"https://api.github.com/users/SunMar/orgs","repos_url":"https://api.github.com/users/SunMar/repos","events_url":"https://api.github.com/users/SunMar/events{/privacy}","received_events_url":"https://api.github.com/users/SunMar/received_events","type":"User","site_admin":false},"created_at":"2017-11-16T21:19:37Z","updated_at":"2017-11-16T21:19:37Z","author_association":"NONE","body":"See defuse/php-encryption#359 for information about PBKDF2 being slow vs using a `Key`. Unfortunately I can't give any benchmarks but our performance tests showed that the PBKDF2 hashing algorithm was forming a big bottleneck, taking up to 50% of a request's total processing time. Once we put some hacks in place to use a `Key` instead, the bottleneck disappeared. The HKDF hashing did not take significantly more time than any other code being run during the request."}}
{"actor":{"display_login":"SunMar"}}