Skip to content

Auth: Reduce bcrypt cost for faster login on small devices #3718

Closed
@lastzero

Description

@lastzero

As a user of a small device like a NAS or a Raspberry Pi, I would like the cost of the bcrypt password to be lower so that logging in does not take a very long time (or even timeout).

The default password cost (2^number of rounds) of most implementations is 11 and the current cost in PhotoPrism is 14, so we reduce it to 121, which is still more secure than what most other applications use:

Cost Iterations
8 256 iterations
9 512 iterations
10 1,024 iterations
11 2,048 iterations
12 4,096 iterations
13 8,192 iterations
14 16,384 iterations
15 32,768 iterations
16 65,536 iterations

Footnotes

  1. Developers can change this value in internal/entity/password.go to use a higher/lower cost in custom builds, depending on their needs.

Metadata

Metadata

Assignees

Labels

enhancementEnhancement or improvement of an existing featureperformancePerformance OptimizationreleasedAvailable in the stable releasesecurityImpact on server or browser securitytestedChanges have been tested successfully

Type

No type

Projects

Status

Release 🌈

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions