Generating multiple keys causes IE8 to display an "unresponsive script" warning.

[shane-tomlinson]

Need to check whether one key causes this error. If not, one idea is to set a short timeout between each key so that IE thinks all is OK.

[lloyd]

Some observations here:

• on my lightening fast VM running winxp/ie8 generation of a single cert pops the non-responsive script error 4x.
• on IE9 simulating IE8 keygen is fast, ~200ms

Some proposals exist to address this problem:

• performance optimizations to the current code (re bigint library, etc) /cc @benadida
• on-demand certificate generation (see issue on-demand cert generation #278)
• move to DSA which will decrease the cost of keygen
• rework certificate generation code to relinquish control to the caller after every unit time of work - effectively making cert generation "restartable".

I believe the order these things are listed above is probably the right order of attack.

[lloyd]

Note: IE8 doesn't have web workers, so that's not a solution.

[benadida]

totally agree with on-demand cert gen. (We can eventually optimize and always re-cert the most-used email on a site, too, but that can wait.)

Reworking keygen code to yield is, IMO, not awesome, as that would require instrumenting very low-level code, especially when we move to something like DSA and the only instrumentation is at the modexp level.

[benadida]

this issue will be focused on the on-demand keygen and cert plus the RSA JS optimizations. Move to other crypto is not part of this scope. If it's still too slow, we'll declare IE8 unsupported until next step.

[benadida]

optimized JS in 7784331

[benadida]

I believe this is closed since @shane-tomlinson has done the on-demand keygen update? Shane can you confirm and close this issue if that part is done?

[shane-tomlinson]

@benadida - This cannot be closed yet. The unresponsive script warning is still displayed in IE8 using a 2.26ghz i5, all running natively, not inside of a VM.

[benadida]

OK, then I think we can't support IE8 until we have DSA. How many times do you get the warning?

[benadida]

@lloyd suggests looking at a 3-4 line fix that would yield to render thread during keygen.

@shane-tomlinson suggests looking at Array creation and push as ways to make things faster.

[benadida]

agreed-on next steps with @lloyd:

• no rewrite of existing library to be async, too complicated.
• make jwcrypto API async
• look into integrating http://ats.oka.nu/titaniumcore/js/crypto/readme.txt
• consider server-generated keys in some cases.

[benadida]

jwcrypto now has asynchronous interfaces for keygen and signing. Now exploring the titaniumcore library to see if it can be used without performance degradation.

[benadida]

with DSA 1024/160, no more warnings.