x/crypto/pbkdf2: Optimize PBKDF2

[Commenter123]

The guy in this YouTube video mentions that Go does not efficiently compute PBKDF2: https://www.youtube.com/watch?v=k_szwKBuNBw&t=418
Starting at 6:58 -- 9:00

I don't understand the internals but please take a look if this is still not optimized from 4i -> 2+2i

[aead]

In general yes.
The pbkdf2 package requires 4n hash operations for n iterations per key block and yes this could be optimized to 2+2n hash operations for n iterations per key block.

The problem is:
The only option (I see) is to use a custom hmac implementation within the pbkdf2 package because the hmac implementation must somehow be told to safe the initial "hash values". This is not possible (so far I can see) for Go's hmac package.

I don't know whether it's worth to implement hmac again within the pbkdf2 package just for performance reasons - but I guess it's not:

If performance is an issue for you, you could use a faster hash function - for example switch form SHA-2 to BLAKE2 (gives a 2-3x speed-up on x86/amd64)

Further PBKDF2 is vulnerable to GPU or FPGA/ASIC password cracking attacks - it's recommended to use a memory-hard function like scrypt or maybe you can wait for argon2 - See #19896

[aead]

@bradfitz I think this can be closed (expect there's a good argument against closing?!)

[bradfitz]

@aead, sounds good. Will do. Thanks for the reply.

[Commenter123]

I don't agree with you closing this issue. The issue is still not fixed and only because the solution might be a bit ugly doesn't mean that the issue no longer exists.
Yes, it might be recommended to use scrypt or bcrypt, but making PBKDF2 nearly twice as fast would also help a bit.

@bradfitz @agl please reopen this issue.

[ianlancetaylor]

@Commenter123 Every change has both benefits and drawbacks. You are focused on the benefits. @aead is saying that the drawbacks outweigh the benefits. This is not something we are going to put our limited resources into.

If this is important to you, I encourage you to write the change yourself. Then we can evaluate it with more information.

[gopherbot]

Change https://golang.org/cl/27458 mentions this issue: crypto/hmac: speed up