Bug 1684461 - Implement gnutls_aead_cipher_(en|de)crypt_vec() API in GnuTLS
Summary: Implement gnutls_aead_cipher_(en|de)crypt_vec() API in GnuTLS
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: gnutls
Version: 8.1
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: 8.0
Assignee: Daiki Ueno
QA Contact: Ondrej Moriš
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-03-01 10:35 UTC by Andreas Schneider
Modified: 2019-11-05 22:26 UTC (History)
6 users (show)

Fixed In Version: gnutls-3.6.8-8.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-11-05 22:26:14 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Gitlab gnutls/gnutls/issues/718 None None None 2019-03-01 10:36:46 UTC
Gitlab gnutls/gnutls/merge_requests/1052 None None None 2019-08-09 12:44:45 UTC
Red Hat Product Errata RHSA-2019:3600 None None None 2019-11-05 22:26:28 UTC

Description Andreas Schneider 2019-03-01 10:35:58 UTC
Please implement:

int gnutls_aead_cipher_encrypt_vec(gnutls_aead_cipher_hd_t handle,
                                   const void *nonce,
                                   size_t nonce_len,
                                   const giovec_t * auth_iov,
                                   int auth_iovcnt,
                                   const giovec_t *iov,
                                   int iovcnt,
                                   void *tag,
                                   size_t *tag_size);

and a corresponding gnutls_aead_cipher_decrypt_vec()

In Samba we work with io vectors (struct iov). Also the encrypt and decrypt functions for a PDU (protocol data unit) get an iov. Using GnuTLS is already a huge speed up, but the passed in iov for transferring big files is 8MB in total. This we have to allocate 8MB for the plain text and 8MB + tag size for the cipher text. Then memcpy the iov into the allocated plain text buffer and pass it to GnuTLS. Once encypted we need to copy the data from the cipher text buffer back into the iov. Performance in Samba matters and as we move to GnuTLS to get better performance we would like to avoid to allocate the memory and copying the data around. The above API would allow us to be even more performant as we don't have to copy so much data around.

The tag being extra makes it easier to use if it is not part of the cihper text. If it is the last iov, you can just pass that to the tag or calculate the position in the iov easily.

Benchmarks: https://hackmd.io/s/S1bJnG4IN

This is related to https://bugzilla.redhat.com/show_bug.cgi?id=1637861

Comment 1 Anderson Sasaki 2019-03-13 16:15:41 UTC
This issue was set to medium priority because this issue does not limit the core functionality of a component.

Comment 10 errata-xmlrpc 2019-11-05 22:26:14 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3600


Note You need to log in before you can comment on or make changes to this bug.