MD5Crypt takes up high CPU about go-http-auth HOT 3 CLOSED

reference：https://www.docs4dev.com/docs/zh/apache/2.4/reference/misc-password_encryptions.html

from go-http-auth.

I am trying to understand your concern.

First to answer your questions about changing or tweaking the number of iterations: no, this cannot be changed. This is the standard MD5Crypt implementation, which requires exactly 1000 iterations of this loop, no more and no less. Changing the number of iterations will change the computed hash and make this code incompatible with any other implementation of the MD5Crypt.

I think the only part of this package which uses MD5Crypt is the basic auth implementation in the case when the password is also stored in MD5Crypt form. In this case the MD5Crypt is called exactly once per HTTP query to encrypt the plain text password sent in basic authentication to the MD5Crypt hash. I'm not sure there is a faster way of doing the same thing.

What exactly is the solution you are looking for?

from go-http-auth.

I am trying to understand your concern.

First to answer your questions about changing or tweaking the number of iterations: no, this cannot be changed. This is the standard MD5Crypt implementation, which requires exactly 1000 iterations of this loop, no more and no less. Changing the number of iterations will change the computed hash and make this code incompatible with any other implementation of the MD5Crypt.

I think the only part of this package which uses MD5Crypt is the basic auth implementation in the case when the password is also stored in MD5Crypt form. In this case the MD5Crypt is called exactly once per HTTP query to encrypt the plain text password sent in basic authentication to the MD5Crypt hash. I'm not sure there is a faster way of doing the same thing.

What exactly is the solution you are looking for?

Thank you very much for your prompt reply. My expectation is to minimize the number of encryption and decryption operations. After asking this questions, I found out the algorithm principle of MD5Crpt, reference：https://www.docs4dev.com/docs/zh/apache/2.4/reference/misc-password_encryptions.html

Taking into account my usage scenarios and demands, I replaced the algorithm, and finally used SHA, the reason is

1. Every request requires authentication(mybe this require should be optimized later)
2. All requests are the authentication process between internal systems, similar to a gentleman aggreement

@abbot

from go-http-auth.