为什么bcrypt库的CompareHashAndPassword方法很慢？

Question

I want to compare password and use bcrypt library but CompareHashAndPassword method is very slow. Why this method is slow?

var b  []byte =  []byte("1234")
 var bx  []byte =  []byte("$2a$14$RWV9NhWmlQmSoV9toM/k9OIzaNcYssCiauPVAljiX2NGhqvyxcOMy")
 fmt.Println("Start Compare: ", time.Now().Format("2006-01-02 15:04:05.000000"))
 err := bcrypt.CompareHashAndPassword(bx, b)
 fmt.Println("Completed Compare: ", time.Now().Format("2006-01-02 15:04:05.000000"))
 fmt.Println("------------------------")

Result:

Start Compare: 2018-03-22 22:53:09.142380

Completed Compare: 2018-03-22 22:53:10.347585

Can you help me?

Answer 1

Slowness is a design feature of bcrypt, because if it was fast, it would be easy to brute-force password hashes. From Wikipedia:

Besides incorporating a salt to protect against rainbow table attacks, bcrypt is an adaptive function: over time, the iteration count can be increased to make it slower, so it remains resistant to brute-force search attacks even with increasing computation power.