Bug 1022002 - AESNI broken in openssl-1.0.1e-15.el6.x86_64
Summary: AESNI broken in openssl-1.0.1e-15.el6.x86_64
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: doc-Technical_Notes
Version: 6.5
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Eliska Slobodova
QA Contact: QE Internationalization Bugs
URL:
Whiteboard:
Keywords: Documentation
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-10-22 13:14 UTC by James Findley
Modified: 2014-10-04 16:40 UTC (History)
2 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2013-11-22 11:20:54 UTC


Attachments (Terms of Use)

Description James Findley 2013-10-22 13:14:37 UTC
Description of problem:

The new version of openssl shipped in RHEL 6.5 breaks aesni hardware accelleration.

There are two problems, firstly that the engine .so is missing (although I believe this is probably deliberate it should be documented as attempting to specify this engine now results in an error)

The second problem is that the accelleration isn't enabled in core.

This means that on a modern intel CPU, aes-128-cbc speed (as tested by openssl speed -evp aes-128-cbc) drops from around 691902.42k to 22027.95k (1024 keysize) between RHEL 6.4 and RHEL 6.5 - which obviously isn't acceptable.

Disabling the disable-aesni patch (patch number 67) fixes the problem, but as the patch looks like it's there to provide an optional (and disabled by default) way to turn off aesni at build time, it's unclear why this is.

Version-Release number of selected component (if applicable):

openssl-1.0.1e-15.el6.x86_64

How reproducible:

Always

Steps to Reproduce:
1. Start with RHEL 6.4.  Run openssl speed -evp aes-128-cbc
2. Update to RHEL 6.5
3. Run openssl speed -evp aes-128-cbc again

Actual results:

roughly 30x slowdown

Expected results:

no slowdown at all.

Additional info:

Comment 2 James Findley 2013-10-22 13:52:22 UTC
Apologies for the noise - this was actually caused by buggy power management on the test server that only showed up once updated.

It might be worth mentioning in the docs that the external engine for aesni has gone away, and that it no longer needs to be manually enabled, though.

Comment 3 Tomas Mraz 2013-10-22 14:04:07 UTC
We will document it in the errata text. Reassigning to release notes for further documentation consideration.

Comment 4 Eliska Slobodova 2013-10-24 13:06:52 UTC
The following text has been added in the Technical Notes book as agreed with Tomas:

The external Advanced Encryption Standard (AES) New Instructions (AES-NI) engine is no longer available in openssl; the engine is now built-in and therefore no longer needs to be manually enabled.


Note You need to log in before you can comment on or make changes to this bug.