Benchmarking Password Hashing Across Architectures
Comparing PBKDF2 performance on Macbook Pro M4 Pro and AMD Ryzen 9 9950X, highlighting language and hardware differences.
Stock photo for illustration only, not from the actual event
- Developing on a new laptop doesn't guarantee the same cloud performance
- PBKDF2 tested with 16-byte salt, 64-byte secret, and 500k iterations
- Apple M-series chips show a clear advantage in hashing tasks
- Choosing different crates in Rust significantly impacts performance
Software development often takes place on brand-new, high-end laptops, but the resulting code frequently runs on cloud environments with entirely different underlying architectures. This hardware discrepancy is a critical factor that many developers overlook during the building phase.
A recent post on Dev.to explored the performance of password hashing across various hardware architectures and programming languages. The experiment utilized the PBKDF2 function with SHA256, setting a salt length of 16 bytes, a secret length of 64 bytes, and 500,000 iterations.
Stock photo for illustration only, not from the actual event
The benchmark demo apps were built in optimized modes: Rust in release mode, Odin with -o:speed, and Zig with -D ReleaseSafe. Testing was conducted across two primary hardware setups: a Macbook Pro M4 Pro running MacOS 15.7.5 and an AMD Ryzen 9 9950X running CachyOS with Linux Kernel 7.1.8.
Based on eyeball averages across multiple runs on the Macbook Pro M4 Pro, Rust using the aws-lc-rs crate took 66ms, Rust using the ring crate took 103ms, Odin clocked in at 98ms, and Zig took 103ms.
Meanwhile, the AMD Ryzen 9 9950X recorded 93ms for Rust (aws-lc-rs), 140ms for Rust (ring), 123ms for Odin, and 171ms for Zig. These figures demonstrate a clear performance advantage for Apple's M-series silicon in these specific cryptographic workloads.
This experiment highlights that developers cannot simply assume code will perform identically across different hardware platforms. Furthermore, choosing one library over another within the same language—such as selecting aws-lc-rs over ring in Rust—can yield substantial performance gains, potentially allowing developers to increase hashing iterations for stronger security without a performance penalty.
While not every developer has access to multiple hardware setups or the latest machinery, understanding that production hardware may differ from development environments is essential. For computationally expensive tasks that could potentially block server threads, testing directly against production-grade hardware remains the best practice.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment