Answer a question

check_password_hash is taking much longer than the expected. Tested with Werkzeug 0.12 and 0.9. The test below shows that checking a password is taking about 2 seconds. Why does it take so long?

The project uses GAE -google app engine. And it is deployed on GAE. Not sure if GAE has werkzeug libraries that could overwrite the one that I have installed. I use the GAE SDK version 1.9.50

def verify_password(self, password):
    logging.info(self.password_hash)
    logging.info(str(datetime.now()))
    result = check_password_hash(self.password_hash, password)
    logging.info(str(datetime.now()))
    return result

hash:pbkdf2:sha256:......................................
2017-07-28 13:52:14.904270
2017-07-28 13:52:17.041060

================= EDIT 1 ============ OK, seems that I haven't cleared my libraries folder completely. I have tried multiple times and upgrading from Werkzeug==0.9.6 to Werkzeug==0.12 solves the problem. Downgrading to 0.9.6 returns the problem back.

That fixed the problem only on my machine. On the GAE server the delay is still there. ================= EDIT 2 ============ After creating very minimalistic project, I tested again and on GAE the behavior was the same. Then I saw that in my database there were two types of passwords: one with sha1 and other with sha256. Those that were sha1 were working fast on GAE as well.

Answers

At the beginning I thought that the problem is because of the difference between sha1 and sha256. However, it's the number of iterations used when creating the password that affects the hash time. http://werkzeug.pocoo.org/docs/0.12/utils/#werkzeug.security.generate_password_hash At some point, the default was increased from 1000 to 50000.

Reducing the number of iterations back to 1000 makes hashing faster, at the expense of reduced security.

generate_password_hash(password, method='pbkdf2:sha256:1000')

In the database I had passwords with both types, some generated before upgrading Werkzeug and some after.

pbkdf2:sha1:1000$.......
pbkdf2:sha256:50000$......

So the difference between the first and the second one was huge because of 1000 vs 50000 iterations.