Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-96088

OpenSSL FIPS_selftest_failed locking overhead

Linking RHIVOS CVEs to...Migration: Automation ...RHELPRIO AssignedTeam ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Major Major
    • None
    • rhel-8.10
    • openssl
    • None
    • No
    • None
    • rhel-security-crypto
    • ssg_security
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • x86_64
    • None

      What were you trying to do that didn't work?

      When using OpenSSL in FIPS mode, we see a noticeable overhead from CRYPTO_THREAD_read_lock and CRYPTO_THREAD_UNLOCK. This appears to come from FIPS_selftest_failed

      What is the impact of this issue to you?

      System performance overhead in an application that uses openssl to encrypt/decrypt data going to disks, where we spend additional CPU time just managing the lock state vs doing the encryption or other application related work.

      Please provide the package NVR for which the bug is seen:

      openssl 1.1.1k

      How reproducible is this bug?:

      100% of the time when doing encryption/decryption operations in parallel amongst multiple threads within one of our applications

      Steps to reproduce

      1. Make calls into EVP_CIPHER* (like EVP_CIPHER_CTX_new, EVP_CIPHER_CTX_reset, EVP_CIPHER_CTX_free, EVP_CipherInit)
      2. Do this in parallel in the same application across multiple threads
      3. Do perf top / perf record of the application, and locking overhead will show up

      Expected results

      Not as much locking overhead as there is now

      Actual results

      More overhead with locking than we'd like

              dbelyavs@redhat.com Dmitry Belyavskiy
              jonkohler Jon Kohler
              Nutanix Confidential Group
              Dmitry Belyavskiy Dmitry Belyavskiy
              Georgios Stavros Pantelakis Georgios Stavros Pantelakis
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: