title: PasswordDeriveBytes vs Rfc2898DeriveBytes, Obsolete but way faster
body: <p>I'm working on a encryption functionality based on classes inherited from SymmetricAlgorithm such as TripleDes, DES, etc.</p>
  
  <p>Basically there're two options to generate consistent key and IV for my algorithm class, <code>PasswordDeriveBytes</code> and <code>Rfc2898DeriveBytes</code>, both inherit from DeriveBytes abstract class.</p>
  
  <p>The <code>PasswordDeriveBytes.GetBytes()</code> method is marked as obsolete in .NET framework while Rfc2898DeriveBytes.GetBytes() is recommended, as it matches the PBKDF2 standard. However, based on my testing, calling the same <code>GetBytes()</code> method in Rfc2898DeriveBytes class is almost 15 times slower than that in <code>PasswordDeriveBytes</code> class, which leads to unexpected CPU usage (always higher than 50%).</p>
  
  <p>Here're some testing data:</p>
  
  <ul>
  <li>Iterations: 100</li>
  <li>Algorithm type: DES</li>
  <li>Original Text: "I'm a test key, encrypt me please"  </li>
  <li>Time:
  
  <ul>
  <li>PasswordDeriveBytes: 99ms</li>
  <li>Rfc2898DeriveBytes: 1,373ms</li>
  </ul></li>
  </ul>
  
  <p>Based on the testing, the bad performance of <code>Rfc2898DeriveBytes</code> is not acceptable in production environment. </p>
  
  <p>Has anyone noticed this problem before? Any solution I can still use a standard one without hitting the performance? Any risk to use an obsolete method (could be removed in future version)?</p>
  
  <p>Thanks guys!</p>
  
  <p><strong>Edit:</strong></p>
  
  <p>Probably I found where the problem is... The default iteration count number for <code>PasswordDeriveBytes</code> is 100, while for <code>Rfc2898DeriveBytes</code> is 1000. After I changed them to the same number as 1000, executing <code>Rfc2898DeriveBytes</code> is only double time.</p>