Bug 1570600 - krb5-libs uses slow crypto implementation
Summary: krb5-libs uses slow crypto implementation
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: krb5
Version: 7.4
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Robbie Harwood
QA Contact: Patrik Kis
URL:
Whiteboard:
Depends On: 1570910 1599721
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-23 10:15 UTC by Heinrich Mislik
Modified: 2018-10-30 08:08 UTC (History)
2 users (show)

Fixed In Version: krb5-1.15.1-33.el7
Doc Type: Bug Fix
Doc Text:
Cause: krb5 used its own crypto implementations more often than needed. Consequence: smbclient is slow due to inefficient sha256 implementation in krb5. Fix: Use openssl for crypto more often. Result: More performance; 50% for this use case. Additionally, when the system is in FIPS mode, krb5 will strictly enforce a FIPS-compliant cipher list.
Clone Of:
: 1570910 (view as bug list)
Environment:
Last Closed: 2018-10-30 08:08:13 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:3071 None None None 2018-10-30 08:08:49 UTC

Description Heinrich Mislik 2018-04-23 10:15:55 UTC
Description of problem:

in krb5.spec --with-crypto-impl is not specified, resulting in --with-crypto-impl=builtin. The builtin routines seem rather slow and CPU intensive. Adding --with-crypto-impl=openssl can reduce processing time by ca. 50%

Version-Release number of selected component (if applicable):

krb5-libs-1.15.1-19.el7.x86_64

How reproducible:

One affected application is samba server joined to AD, where connection setup with kerberos is slowed down. The following was run against VMWare server with 2 CPUs.

kinit someuser@SOMEREALM
for i in `seq 1 10` ; do time smbclient //someserverinad/someshare -k -c exit & sleep .1 ; done

Load on samaba server goes up, responses take up to 8 seconds.
perf top shows excessive CPU usage by:

 17.26%  libk5crypto.so.3.1                     [.] k5_sha256_update     

After rebuilding krb5-libs with configure option --with-crypto-impl=openssl response times go down to 4 seconds.

Additional info:

openssl already is a requisite for krb5-libs, so adding this option should not have any impact.

400ms for session setup may seem not so much and under normal conditions is no problem. After a server restart or network outage Windows clients tend to reconnect rather agressive, resulting in much more then 10 connections per second (like in my test above) and having the samba server completely unresponsive for minutes.

Cheers

Heinrich

Comment 15 errata-xmlrpc 2018-10-30 08:08:13 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:3071


Note You need to log in before you can comment on or make changes to this bug.