Performance using pkbdf2sync vs crypto.webcrypto.subtle is significantly faster even if blocking

[az-nextsec]

Node.js Version

v18.20.4

NPM Version

v10.7.3

Operating System

macOS, Linux

Subsystem

crypto

Description

We have been tasked with trying to optimise performance of our node application which runs in GKE Autopilot (Docker) with some convoluted third-party dependencies.

In investigating the issue we found that we had a range of calls that boiled down to three things:

1. Sha1 hash
2. PBKDF2
3. AES-GCM using output of PBKDF2

We were surprised to find pbkdf2 described as a use case here: https://nodejs.org/en/learn/getting-started/profiling

We re-wrote those using crypto.webcrypto.subtle implementation (using unit tests to ensure parity of output) and on the local developer machine things appeared to work faster (marginally, some 10-20% improvement, but still). Encouraged by this we deployed our application to the environment only to find that it is some 4-16 times SLOWER than when using blocking code.

When we ran the -perf option the ouptut shows equivalent of :

 [Summary]:
   ticks  total  nonlib   name
    159    1.2%   97.0%  JavaScript
      0    0.0%    0.0%  C++
    590    4.4%  359.8%  GC
  13320   98.8%          Shared libraries
      5    0.0%          Unaccounted

 [Shared libraries]:
   ticks  total  nonlib   name
   9568   71.0%          /usr/local/bin/node
   3638   27.0%          /lib/ld-musl-x86_64.so.1
    109    0.8%          /usr/lib/libstdc++.so.6.0.32
      3    0.0%          7f891c3cc000-7f891c3ce000
      2    0.0%          /usr/lib/libgcc_s.so.1

Which shows that most of the ticks find themselves in 'shared libraries' with no way for us to know exactly what is going on.

When using chrome profiler locally the synchronous version of our code correctly shows pbkdf2sync bubbling up to the top; and asynchronous doesn't have it. However performance gains are non-existent in the environment.

What are we doing wrong and what else can we try?

Minimal Reproduction

No response

Output

No response

Before You Submit

• I have looked for issues that already exist before submitting this
• My issue follows the guidelines in the README file, and follows the 'How to ask a good question' guide at https://stackoverflow.com/help/how-to-ask

[preveen-stack]

@nodejs/crypto can you take a look

[gireeshpunathil]

Which shows that most of the ticks find themselves in 'shared libraries' with no way for us to know exactly what is going on.

can you inspect the [Bottom up (heavy) profile] section in the log? that would give the break-up of the consumption in the shared libraries.