7

In our web-application, we use jBcrypt for hashing passwords. We use 13 log_rounds when hashing the password.

Normally, BCrypt.checkpw() takes about 1 second. But from time to time (after a few days), it suddenly starts getting slow and takes almost 30 seconds from that time on and does not recover to normal speed.Restarting Tomcat is the only things that helps here.

I wouldn't wonder if that happened from time to time, for example if there is a high CPU load or a GC is running. But that's not the case, it just suddenly starts getting slow. Only the login-process is affected, the rest of the application is still fast. We also do not have any determinable memory leaks or other performance issues. It's just BCrypt.checkpw() that is slow. A thread-dump shows that the time is consumed by BCrypt.checkpw and subsequent method calls, especially BCrypt.encipher:

Thread 8597: (state = IN_JAVA)
 - org.mindrot.jbcrypt.BCrypt.encipher(int[], int) @bci=0, line=490 (Interpreted frame)
 - org.mindrot.jbcrypt.BCrypt.key(byte[]) @bci=122, line=562 (Interpreted frame)
 - org.mindrot.jbcrypt.BCrypt.crypt_raw(byte[], byte[], int) @bci=89, line=629 (Compiled frame)
 - org.mindrot.jbcrypt.BCrypt.hashpw(java.lang.String, java.lang.String) @bci=226, line=692 (Interpreted frame)
 - org.mindrot.jbcrypt.BCrypt.checkpw(java.lang.String, java.lang.String) @bci=3, line=763 (Interpreted frame)

I've only found one similar issue here on SO, but multiple Classloaders can not be an issue in our case: Variable and degrading performance when using jbcrypt

Does anyone have an idea what's happening here?

Community
  • 1
  • 1
Matthias M.
  • 211
  • 3
  • 7
  • 1
    As it turned out, this seemed to be a garbage collector issue. Although it is recommended to use `-XX:+UseConcMarkSweepGC` for production environments (we're using Java 1.7), this caused long stop-the-world pauses. Aftter returning to `-XX:+UseParallelOldGC`, the issue disappeared. – Matthias M. Jan 05 '16 at 08:47
  • Hello Matthias, we are facing the same issue, we've also tried changing the GC but did not resolve this issue. Di you make any other changes to your project or jvm? – George Artemiou Feb 11 '16 at 13:46
  • Same probleme here in Magnolia CMS. Tomcat is running for weeks without problems, suddenly logins take exactly 15 seconds. I am already using -Djava.security.egd=file:/dev/./urandom – ropo Jun 08 '16 at 14:50

0 Answers0