Bug 1022002

Summary:	AESNI broken in openssl-1.0.1e-15.el6.x86_64
Product:	Red Hat Enterprise Linux 6	Reporter:	James Findley <james.findley>
Component:	doc-Technical_Notes	Assignee:	Eliska Slobodova <eslobodo>
Status:	CLOSED CURRENTRELEASE	QA Contact:	QE Internationalization Bugs <qe-i18n-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.5	CC:	lagarcia, rmarti
Target Milestone:	rc	Keywords:	Documentation
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-11-22 11:20:54 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description James Findley 2013-10-22 13:14:37 UTC

Description of problem:

The new version of openssl shipped in RHEL 6.5 breaks aesni hardware accelleration.

There are two problems, firstly that the engine .so is missing (although I believe this is probably deliberate it should be documented as attempting to specify this engine now results in an error)

The second problem is that the accelleration isn't enabled in core.

This means that on a modern intel CPU, aes-128-cbc speed (as tested by openssl speed -evp aes-128-cbc) drops from around 691902.42k to 22027.95k (1024 keysize) between RHEL 6.4 and RHEL 6.5 - which obviously isn't acceptable.

Disabling the disable-aesni patch (patch number 67) fixes the problem, but as the patch looks like it's there to provide an optional (and disabled by default) way to turn off aesni at build time, it's unclear why this is.

Version-Release number of selected component (if applicable):

openssl-1.0.1e-15.el6.x86_64

How reproducible:

Always

Steps to Reproduce:
1. Start with RHEL 6.4.  Run openssl speed -evp aes-128-cbc
2. Update to RHEL 6.5
3. Run openssl speed -evp aes-128-cbc again

Actual results:

roughly 30x slowdown

Expected results:

no slowdown at all.

Additional info:

Comment 2 James Findley 2013-10-22 13:52:22 UTC

Apologies for the noise - this was actually caused by buggy power management on the test server that only showed up once updated.

It might be worth mentioning in the docs that the external engine for aesni has gone away, and that it no longer needs to be manually enabled, though.

Comment 3 Tomas Mraz 2013-10-22 14:04:07 UTC

We will document it in the errata text. Reassigning to release notes for further documentation consideration.

Comment 4 Eliska Slobodova 2013-10-24 13:06:52 UTC

The following text has been added in the Technical Notes book as agreed with Tomas:

The external Advanced Encryption Standard (AES) New Instructions (AES-NI) engine is no longer available in openssl; the engine is now built-in and therefore no longer needs to be manually enabled.

Comment 5 Eliska Slobodova 2013-11-22 11:20:54 UTC

Closing; the book is available online:

https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/6.5_Technical_Notes/index.html