How to improve performance of CI_Encrypt->_add_cipher_noise?

Question

I've been trying to track down some performance issues with an ExpressionEngine site, specifically around pages using CartThrob. I've been using XDebug and Webgrind, and noticed that CI_Encrypt->encode was causing the bulk of my performance issues.

Much of the problem was resolved by enabling the PHP mcrypt module, although CI_Encrypt still seems to be the major bottleneck in my application.

Now, the problem seems to be with CI_Encrypt->_add_cypher_noise, which is taking almost 1.5 seconds to run just 40 times, accounting for over half of my page load time.

Is there any way to improve the performance of this function?

Answer 1

The following article suggests that the Codeigniter add_cipher_noise method might fall in the category "don’t come up with your own way to solve a (possible) vulnerability". I doubt this will be fixed.

The article suggests using hmac over the IV. I don't know if you could shoehorn in using the PHP internal hash_hmac() function instead of the custom add_cipher_noise, and/or if that would/could speed up things.

http://www.cryptofails.com/post/70059597528/codeigniter-encryption-is-not-authentication (juli 2013)

EDIT : CodeIgniter 3.dev has a new library that adds standard authenticated encryption. (old: Encrypt.php new/extra Encryption.php). https://github.com/EllisLab/CodeIgniter/blob/develop/system/libraries/Encryption.php
and here is the raw manual
https://github.com/EllisLab/CodeIgniter/blob/develop/user_guide_src/source/libraries/encryption.rst