What happened? The performance of jsonwebtoken 9.0.2 is 50 times slower than 8.5.1 #966

Activity

1. panga commented on Apr 15, 2024

   

   panga

   on Apr 15, 2024

   More actions

   Confirmed the performance regression.

   Looks like it was introduced in ecdf6cc by adding a crypto.createSecretKey call to create a KeyObject instead of using the string secret or PEM file. This was done to address some security vulnerabilities.

   The regression can be workaround in 9.0.2 by passing a KeyObject directly to sign/verify methods.
2. panva commented on Oct 3, 2024

   

   panva

   on Oct 3, 2024

   Member

   More actions

   I strongly suggest passing any key material as KeyObject instances.

   This is especially beneficial for HMAC based algorithms since it avoids the library having to guess what type of key (or secret) is passed.

   const secret = crypto.createSecretKey(Buffer.from('your secret'))

   👍React with 👍1Reacted by Erik Johansson
3. panva commented on Oct 3, 2024

   

   panva

   on Oct 3, 2024

   Member

   More actions

   See the difference when KeyObject is used. secret with crypto.createSecretKey, public keys with crypto.createPublicKey, private keys with crypto.createPrivateKey

   Before:

   Signing
   HS256 x 3,945 ops/sec ±1.07% (98 runs sampled)
   RS256 x 892 ops/sec ±1.86% (99 runs sampled)
   ES256 x 3,286 ops/sec ±1.08% (97 runs sampled)
   
   Verification
   HS256 x 3,809 ops/sec ±0.67% (96 runs sampled)
   RS256 x 9,239 ops/sec ±0.83% (97 runs sampled)
   ES256 x 6,234 ops/sec ±1.62% (95 runs sampled)
   

   After:

   Signing
   HS256 x 249,222 ops/sec ±0.83% (94 runs sampled)
   RS256 x 1,741 ops/sec ±0.86% (100 runs sampled)
   ES256 x 36,444 ops/sec ±0.90% (93 runs sampled)
   
   Verification
   HS256 x 186,174 ops/sec ±0.38% (95 runs sampled)
   RS256 x 43,935 ops/sec ±0.59% (100 runs sampled)
   ES256 x 16,091 ops/sec ±0.67% (99 runs sampled)
   
4. panva commented on Oct 3, 2024

   

   panva

   on Oct 3, 2024

   Member

   More actions

   @frederikprijck let's figure out how to change the docs to indicate the inputs SHOULD be KeyObject instances and that other means of passing key material are strictly for convenience.

   👍React with 👍2Reacted by Frederik Prijck and Erik Johansson