MD5Crypt takes up high CPU

[Tovi163]

[Scene]
hi all

we use the go-http-auth for request authrization, but it takes up high CPU usage, the CPU graph as follows:

[Code analysis]
According to the code, we see there is 1000 times loop for computing "final", we want to know if the operation is in line with expectations.

The questions are as follows:

1. Can we delete the loop ?
2. If you want to save the mechanism, Whether to consider the parameters(1000 times loop) can be configured?
   

Thanks a lot !

[Tovi163]

reference：https://www.docs4dev.com/docs/zh/apache/2.4/reference/misc-password_encryptions.html

[abbot]

I am trying to understand your concern.

First to answer your questions about changing or tweaking the number of iterations: no, this cannot be changed. This is the standard MD5Crypt implementation, which requires exactly 1000 iterations of this loop, no more and no less. Changing the number of iterations will change the computed hash and make this code incompatible with any other implementation of the MD5Crypt.

I think the only part of this package which uses MD5Crypt is the basic auth implementation in the case when the password is also stored in MD5Crypt form. In this case the MD5Crypt is called exactly once per HTTP query to encrypt the plain text password sent in basic authentication to the MD5Crypt hash. I'm not sure there is a faster way of doing the same thing.

What exactly is the solution you are looking for?

[Tovi163]

I am trying to understand your concern.

First to answer your questions about changing or tweaking the number of iterations: no, this cannot be changed. This is the standard MD5Crypt implementation, which requires exactly 1000 iterations of this loop, no more and no less. Changing the number of iterations will change the computed hash and make this code incompatible with any other implementation of the MD5Crypt.

I think the only part of this package which uses MD5Crypt is the basic auth implementation in the case when the password is also stored in MD5Crypt form. In this case the MD5Crypt is called exactly once per HTTP query to encrypt the plain text password sent in basic authentication to the MD5Crypt hash. I'm not sure there is a faster way of doing the same thing.

What exactly is the solution you are looking for?

Thank you very much for your prompt reply. My expectation is to minimize the number of encryption and decryption operations. After asking this questions, I found out the algorithm principle of MD5Crpt, reference：https://www.docs4dev.com/docs/zh/apache/2.4/reference/misc-password_encryptions.html

Taking into account my usage scenarios and demands, I replaced the algorithm, and finally used SHA, the reason is

1. Every request requires authentication(mybe this require should be optimized later)
2. All requests are the authentication process between internal systems, similar to a gentleman aggreement

@abbot