On the claims in @node-rs/argon2 README

[ranisalt]

Hello! Looking for ways to improve argon2 I stumbled upon @node-rs/argon2, and I noticed it makes some bold claims on the README. Most notably, these caught my attention:

• Faster performance.

• Smaller file size after npm installation(476K vs node-argon2 3.7M).

It's clear that you're pointing out the upsides of using @node-rs/argon2 over alternatives, but I failed to verify them.

---

I'll assume that "faster performance" is compared to node-argon2, since your own benchmark compares directly against it.

Running the benchmark unmodified with @node-rs/[email protected] vs [email protected] on my machine (a Ryzen 7 7800X3D running Linux 6.9.1) I get the following results:

@node-rs/argon x 107 ops/sec ±0.42% (85 runs sampled)
node-argon x 77.82 ops/sec ±0.32% (78 runs sampled)

But there's a catch: @node-rs/argon2 defaults are much lower (2 vs 3 iterations, 19K vs 64K memory) and that makes the benchmark unfair. Normalizing the parameters so that both use 3 iterations and 64K memory results in:

@node-rs/argon x 21.56 ops/sec ±0.57% (55 runs sampled)
node-argon x 77.06 ops/sec ±0.41% (75 runs sampled)

So node-argon2 is almost 4x faster than @node-rs/argon2. For that reason, I suggest you specify in the README what is the scenario where @node-rs/argon2 is faster and how much, so that users are not mislead into expecting different results should they migrate.

---

I could not reproduce the installation size either, for node-argon2 that may be because it was changed after the README was written, but I couldn't reproduce either the installation size for @node-rs/argon2:

In a new folder, with an empty project initialized with yarn init -y and after running yarn add @node-rs/argon2

1.37 MB (1,368,064 bytes)

In a new folder, with an empty project initialized with yarn init -y and after running yarn add argon2

1.45 MB (1,454,080 bytes)

That again may be unrealistic if you consider node-argon2 ships all binaries and @node-rs/argon2 selects according to the OS and CPU, so a project that requires cross-architecture support (i.e. an Electron app that supports ARM and x86) will have a higher install size for @node-rs/argon2. In any case, I don't get how the mentioned sizes were measured and I can't get even close to that.

---

I hope you can clarify my doubts, let me know if I also left something unclear in the text. Thanks in advance!

[aleclarson]

Solid post that deserves a reply.

[ranisalt]

@aleclarson likely never will 🤷 it's still on README

[kaaax0815]

I modified the benchmark to use same memory and time cost and got these results

┌─────────┬─────────────────────────┬───────────────────────┬──────────────────────────┬────────────────────────────┬───────────────────────────┬─────────┐
│ (index) │ Task name               │ Latency average (ns)  │ Latency median (ns)      │ Throughput average (ops/s) │ Throughput median (ops/s) │ Samples │
├─────────┼─────────────────────────┼───────────────────────┼──────────────────────────┼────────────────────────────┼───────────────────────────┼─────────┤
│ 0       │ '@node-rs/argon hash'   │ '96948514.30 ± 1.73%' │ '96528292.00 ± 73583.00' │ '10 ± 1.67%'               │ '10'                      │ 64      │
│ 1       │ 'node-argon hash'       │ '34226297.53 ± 0.22%' │ '34219792.00 ± 7375.00'  │ '29 ± 0.22%'               │ '29'                      │ 64      │
│ 2       │ '@node-rs/argon verify' │ '95447282.56 ± 1.52%' │ '94332729.00 ± 53312.00' │ '11 ± 1.45%'               │ '11'                      │ 64      │
│ 3       │ 'node-argon verify'     │ '34232509.77 ± 0.44%' │ '34054896.00 ± 7354.00'  │ '29 ± 0.43%'               │ '29'                      │ 64      │
└─────────┴─────────────────────────┴───────────────────────┴──────────────────────────┴────────────────────────────┴───────────────────────────┴─────────┘

on a M1 Pro.

So @node-rs/argon2 is almost 3x slower than argon2