Blazor WebAssembly: Rfc2898DeriveBytes.GetBytes() takes 40+ times longer than same code in WPF app.

[LeeActon]

Describe the bug

I have been porting a WPF app to Blazor WebAssembly, and found that Rfc2898DeriveBytes.GetBytes() takes over 40 times longer in WebAssembly as in WPF.
This makes my app unusable.

To Reproduce

Compile the code in the sample app (see github reference below).
Run the WebAssembly app, and Click the "Click me" button. It will display how much time it took.
Then Run the WPF app and do the same thing.
On my machine the WebAssembly version takes around 3.8 to 4.5 seconds whereas the WPF app takes only 0.1 seconds. That's 38 to 45 times longer for WebAssembly.

Further technical details

See the code for full details.

https://github.com/LeeActon/BlazorAppBug

[javiercn]

@LeeActon thanks for contacting us.

This question is not specific to blazor but to the mono implementation of the method. I would suggest you file an issue in the mono repo for a better and faster answer.

As a data point for us, why do you need to do key derivation in the browser?

[LeeActon]

@javiercn I have filed the issue in mono per your recommendation (mono/mono#19789).

The reason for doing key derivation on the client is because I don't want secrets revealed to the server where the secrets are stored.

[javiercn]

@LeeActon You'll likely get better performance just calling https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/deriveKey through jsinterop.

[LeeActon]

@javiercn, Thanks. I will look into that, but it kind of defeats the purpose of sharing C# code on different platforms.

[javiercn]

@LeeActon It should be trivial to invoke with JSInterop and it's ok if 1% of your app uses specialized JS methods when there is a significant advantage over the (slower in this case), .NET implementation.

This issue has been resolved and has not had any activity for 1 day. It will be closed for housekeeping purposes.

See our Issue Management Policies for more information.