From: Eric Dumazet <eric.dumazet@gmail.com>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>, netdev@vger.kernel.org
Cc: linux-crypto@vger.kernel.org, herbert@gondor.apana.org.au,
ebiggers@kernel.org, edumazet@google.com, davem@davemloft.net,
kuznet@ms2.inr.ac.ru, yoshfuji@linux-ipv6.org, jbaron@akamai.com,
cpaasch@apple.com, David.Laight@aculab.com, ycheng@google.com
Subject: Re: [PATCH v3] net: ipv4: move tcp_fastopen server side code to SipHash library
Date: Mon, 17 Jun 2019 10:00:28 -0700 [thread overview]
Message-ID: <e1c4c9b6-3668-106a-69ef-7ef6c016a5f6@gmail.com> (raw)
In-Reply-To: <20190617080933.32152-1-ard.biesheuvel@linaro.org>
On 6/17/19 1:09 AM, Ard Biesheuvel wrote:
> Using a bare block cipher in non-crypto code is almost always a bad idea,
> not only for security reasons (and we've seen some examples of this in
> the kernel in the past), but also for performance reasons.
>
> In the TCP fastopen case, we call into the bare AES block cipher one or
> two times (depending on whether the connection is IPv4 or IPv6). On most
> systems, this results in a call chain such as
>
> crypto_cipher_encrypt_one(ctx, dst, src)
> crypto_cipher_crt(tfm)->cit_encrypt_one(crypto_cipher_tfm(tfm), ...);
> aesni_encrypt
> kernel_fpu_begin();
> aesni_enc(ctx, dst, src); // asm routine
> kernel_fpu_end();
>
> It is highly unlikely that the use of special AES instructions has a
> benefit in this case, especially since we are doing the above twice
> for IPv6 connections, instead of using a transform which can process
> the entire input in one go.
>
> We could switch to the cbcmac(aes) shash, which would at least get
> rid of the duplicated overhead in *some* cases (i.e., today, only
> arm64 has an accelerated implementation of cbcmac(aes), while x86 will
> end up using the generic cbcmac template wrapping the AES-NI cipher,
> which basically ends up doing exactly the above). However, in the given
> context, it makes more sense to use a light-weight MAC algorithm that
> is more suitable for the purpose at hand, such as SipHash.
>
> Since the output size of SipHash already matches our chosen value for
> TCP_FASTOPEN_COOKIE_SIZE, and given that it accepts arbitrary input
> sizes, this greatly simplifies the code as well.
>
> NOTE: Server farms backing a single server IP for load balancing purposes
> and sharing a single fastopen key will be adversely affected by
> this change unless all systems in the pool receive their kernel
> upgrades at the same time.
>
> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> ---
All our fastopen packetdrill tests pass (after I changed all the cookie values in them)
Signed-off-by: Eric Dumazet <edumazet@google.com>
next prev parent reply other threads:[~2019-06-17 17:00 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-17 8:09 [PATCH v3] net: ipv4: move tcp_fastopen server side code to SipHash library Ard Biesheuvel
2019-06-17 17:00 ` Eric Dumazet [this message]
2019-06-17 20:57 ` David Miller
2019-06-17 22:09 ` Eric Dumazet
2019-06-18 4:14 ` Eric Biggers
2019-06-18 6:56 ` Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e1c4c9b6-3668-106a-69ef-7ef6c016a5f6@gmail.com \
--to=eric.dumazet@gmail.com \
--cc=David.Laight@aculab.com \
--cc=ard.biesheuvel@linaro.org \
--cc=cpaasch@apple.com \
--cc=davem@davemloft.net \
--cc=ebiggers@kernel.org \
--cc=edumazet@google.com \
--cc=herbert@gondor.apana.org.au \
--cc=jbaron@akamai.com \
--cc=kuznet@ms2.inr.ac.ru \
--cc=linux-crypto@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=ycheng@google.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).