linux-kernel - RE: kdf108_init() takes over 250 ms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <MW5PR84MB1842811C4EECC0F4B35B5FB3AB709@MW5PR84MB1842.NAMPRD84.PROD.OUTLOOK.COM>
Date:   Tue, 23 Aug 2022 20:10:01 +0000
From:   "Elliott, Robert (Servers)" <elliott@....com>
To:     Paul Menzel <pmenzel@...gen.mpg.de>,
        Stephan Müller <smueller@...onox.de>,
        Tim Chen <tim.c.chen@...ux.intel.com>
CC:     Herbert Xu <herbert@...dor.apana.org.au>,
        "David S. Miller" <davem@...emloft.net>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: RE: kdf108_init() takes over 250 ms


> -----Original Message-----
> From: Paul Menzel <pmenzel@...gen.mpg.de>
> Sent: Tuesday, August 23, 2022 9:52 AM
> To: Stephan Müller <smueller@...onox.de>
> Cc: Herbert Xu <herbert@...dor.apana.org.au>; David S. Miller
> <davem@...emloft.net>; linux-crypto@...r.kernel.org; LKML <linux-
> kernel@...r.kernel.org>
> Subject: kdf108_init() takes over 250 ms
> 
> Dear Stephan,
> 
> On the Dell XPS 13 9370 with Debian sid/unstable, I noticed with Linux
> 5.18.16, that  `crypto_kdf108_init()` takes 263 ms to run even with
> disabled self-tests:
> 
...
> [    0.000000] Command line: BOOT_IMAGE=/vmlinuz-5.18.0-4-amd64
> root=UUID=56f398e0-1e25-4fda-aa9f-611dece4b333 ro quiet
> module_blacklist=psmouse initcall_debug log_buf_len=4M cryptomgr.notests
...
> [    0.272127] calling  crypto_kdf108_init+0x0/0x149 @ 1
> [    0.530787] Freeing initrd memory: 39332K
> [    0.534667] alg: self-tests disabled
> [    0.534701] alg: self-tests for CTR-KDF (hmac(sha256)) passed
> [    0.534703] initcall crypto_kdf108_init+0x0/0x149 returned 0 after
> 262573 usecs
...
> 
> With self-tests enabled it’s only less than a millisecond longer.
> 
> ```
> [    0.282389] calling  crypto_kdf108_init+0x0/0x149 @ 1
> [    0.541096] Freeing initrd memory: 39332K
> [    0.545674] alg: self-tests for CTR-KDF (hmac(sha256)) passed
> [    0.545676] initcall crypto_kdf108_init+0x0/0x149 returned 0 after
> 263284 usecs
> ```

crypto_kdf108_init() call its self-test function directly rather
that alg_test(), which implements that notests flag. Maybe it
should go through alg_test().

Outside of that, check that Tim's x86-optimized SHA-256 module
is loaded, so it is used rather than the generic implementation.
One my system, that improves the kdf108 initialization time 
from 1.4 s to 0.38 s:

With sha256_generic:
  initcall sha256_generic_mod_init+0x0/0x16 returned 0 after 0 usecs
  ...
  initcall crypto_kdf108_init+0x0/0x18d returned 0 after 1425640 usecs

With sha256_ssse3 (using its AVX2 implementation):
  initcall sha256_ssse3_mod_init+0x0/0x1bf returned 0 after 12148 usecs
  ...
  initcall crypto_kdf108_init+0x0/0x153 returned 0 after 382799 usecs

That's controlled by CONFIG_CRYPTO_SHA256_SSSE3.