What happened? The performance of jsonwebtoken 9.0.2 is 50 times slower than 8.5.1

[VxRain]

Description

The performance of jsonwebtoken 9.0.2 is 50 times slower than 8.5.1, mainly in the HS256 algorithm.
The encoding speed has slowed down by 53 times, and the decoding speed by 34 times.

8.5.1 benchmark results

Encoding
HS256 x 120,423 ops/sec ±0.33% (91 runs sampled)
RS256 x 793 ops/sec ±0.50% (94 runs sampled)
ES256 x 2,418 ops/sec ±0.99% (94 runs sampled)
Fastest encoder is HS256

Decoding
HS256 x 87,990 ops/sec ±0.93% (95 runs sampled)
RS256 x 5,921 ops/sec ±0.89% (93 runs sampled)
ES256 x 4,763 ops/sec ±0.77% (94 runs sampled)
Fastest decoder is HS256

---

9.0.2 benchmark results

Encoding
HS256 x 2,264 ops/sec ±4.58% (78 runs sampled)
RS256 x 759 ops/sec ±0.73% (93 runs sampled)
ES256 x 2,131 ops/sec ±1.08% (91 runs sampled)
Fastest encoder is HS256

Decoding
HS256 x 2,568 ops/sec ±0.93% (93 runs sampled)
RS256 x 5,527 ops/sec ±1.60% (87 runs sampled)
ES256 x 3,871 ops/sec ±1.62% (91 runs sampled)
Fastest decoder is RS256

Reproduction

https://github.com/VxRain/node-jwt-benchmark

Environment

• Node: v20.12.2
• System: Win11
• CPU: AMD R7 5800H

[panga]

Confirmed the performance regression.

Looks like it was introduced in ecdf6cc by adding a crypto.createSecretKey call to create a KeyObject instead of using the string secret or PEM file. This was done to address some security vulnerabilities.

The regression can be workaround in 9.0.2 by passing a KeyObject directly to sign/verify methods.