createSecretKey and hmac (e.g. in fastify/cookie)

[Uzlopak]

I wanted to have an open discussion regarding the use of secret keys in hmac.

I think we can have performance improvements by using createSecretKey. Atleast it seems that the heap usage could be reduced.

We should consider investigating this?!

I am opening this issue to not forget about it. It is 2 o clock in the morning and I saw this potential perf improvement while checking the performance of a different product. Good night.

@kibertoad
@Fdawgs
@Eomm
@gurgunday
@mcollina

[mcollina]

secret keys... for what? Do we have an hot path where we create a lot of keys?

[Fdawgs]

@Uzlopak I know this is very old, mind clarifying?

[Uzlopak]

Well, there is a function in node crypto called createSecretKey. If you pass strings or even buffers as keys to node crypto functions like hmac, then they get validated and internally converted to SecretKey Instances. Internally crypto functions first Check if the provider key is an instanceof SecretKey.

So If you convert the strings or buffers at start of the server, then you can use the fast path and avoid validation of the secret on every request.