"async" argon2 freezes the main event loop

[ChALkeR]

Original detect from @deepview-autofix:

To validate:

import { argon2, randomBytes } from 'node:crypto'

const parameters = {
  message: 'password',
  nonce: randomBytes(16),
  parallelism: 4,
  tagLength: 64,
  memory: 65536,
  passes: 1000, // the only thing changed from doc to demonstrate
};

console.log(`Start at ${new Date().toISOString()}`)
argon2('argon2id', parameters, () => {})
console.log(`Unblocked at ${new Date().toISOString()}`) // this takes 10 seconds on my Air

cc @panva perhaps?

Likely too complex for an autofix.

Also does not qualify to be a security bug, hence public.

[panva]

FYI the API is still in

Stability: 1.2 - Release candidate

cc @jasnell @ranisalt

[ChALkeR]

FYI the API is still in

Yes, I'm aware, and that's precisely why this is public!

[panva]

Yes, I'm aware, and that's precisely why this is public!

I'm aware that you're aware :) Just calling it out for clarity.

[panva]

@ChALkeR what about the scrypt or PBKDF2 jobs?

[ChALkeR]

I'm aware that you're aware :) Just calling it out for clarity.

It had "FYI" so I replied 😄

@ChALkeR what about the scrypt or PBKDF2 jobs?

@panva scrypt is fine:

console.time('ASync')
console.time('Sync')
scrypt('password', 'salt', 64, { N: 2**18, maxmem: 2**30 }, () => console.timeEnd('ASync'))
console.timeEnd('Sync')

Sync: 0.4ms
ASync: 416.924ms

pbkdf2 is fine too:

console.time('ASync')
console.time('Sync')
pbkdf2('secret', 'salt', 1e6, 64, 'sha512', () => console.timeEnd('ASync'))
console.timeEnd('Sync')

Sync: 0.117ms
ASync: 201.389ms

---

compare to argon2:

console.time('ASync')
console.time('Sync')
argon2('argon2id', parameters, () => console.timeEnd('ASync'))
console.timeEnd('Sync')

passes=10 (parameters from doc example):

Sync: 117.201ms
ASync: 217.662ms

passes=100:

Sync: 974.533ms
ASync: 2.034s

passes=1000:

Sync: 8.570s
ASync: 16.860s

It literally is just computed twice: once in sync, once in async, per every async call (at least judging from the numbers)