why mcrypt_create_iv is slow

If you don't specify argument for mcrypt_create_iv(), it will use /dev/random(on Linux) by default as a random number generator. The problem of /dev/random is that it's random pool depends on the system interrupts, when there is not enough system interrupts, it cannot generate enough random numbers, then the process tries to get the random numbers will wait and hang.

So instead of 

mcrypt_create_iv($size)

use 

mcrypt_create_iv($size, MCRYPT_DEV_URANDOM); 

See the difference then