Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1684461 - Implement gnutls_aead_cipher_(en|de)crypt_vec() API in GnuTLS
Summary: Implement gnutls_aead_cipher_(en|de)crypt_vec() API in GnuTLS
Keywords:
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: gnutls
Version: 8.1
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: 8.0
Assignee: Anderson Sasaki
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-03-01 10:35 UTC by Andreas Schneider
Modified: 2019-03-19 12:57 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Gitlab gnutls/gnutls/issues/718 None None None 2019-03-01 10:36:46 UTC

Description Andreas Schneider 2019-03-01 10:35:58 UTC
Please implement:

int gnutls_aead_cipher_encrypt_vec(gnutls_aead_cipher_hd_t handle,
                                   const void *nonce,
                                   size_t nonce_len,
                                   const giovec_t * auth_iov,
                                   int auth_iovcnt,
                                   const giovec_t *iov,
                                   int iovcnt,
                                   void *tag,
                                   size_t *tag_size);

and a corresponding gnutls_aead_cipher_decrypt_vec()

In Samba we work with io vectors (struct iov). Also the encrypt and decrypt functions for a PDU (protocol data unit) get an iov. Using GnuTLS is already a huge speed up, but the passed in iov for transferring big files is 8MB in total. This we have to allocate 8MB for the plain text and 8MB + tag size for the cipher text. Then memcpy the iov into the allocated plain text buffer and pass it to GnuTLS. Once encypted we need to copy the data from the cipher text buffer back into the iov. Performance in Samba matters and as we move to GnuTLS to get better performance we would like to avoid to allocate the memory and copying the data around. The above API would allow us to be even more performant as we don't have to copy so much data around.

The tag being extra makes it easier to use if it is not part of the cihper text. If it is the last iov, you can just pass that to the tag or calculate the position in the iov easily.

Benchmarks: https://hackmd.io/s/S1bJnG4IN

This is related to https://bugzilla.redhat.com/show_bug.cgi?id=1637861

Comment 1 Anderson Sasaki 2019-03-13 16:15:41 UTC
This issue was set to medium priority because this issue does not limit the core functionality of a component.


Note You need to log in before you can comment on or make changes to this bug.