TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

The State of SSL Stacks

146 点作者 zdw8 天前

13 条评论

jaas4 天前
&gt; We also tested Rustls and its rustls-openssl-compat layer. Rustls could be an interesting library in the future, but the OpenSSL compatibility application binary interface (ABI) was not complete enough to make it work correctly with HAProxy in its current state.<p>Rustls is actively working on improving the OpenSSL compatibility layer. Hopefully we&#x27;ll have it fully working for HAProxy soon!<p>We&#x27;ve also invested a lot in performance. Next week we&#x27;ll be publishing a blog post about Rustls server side performance. Since it&#x27;s relevant to discussions about TLS stack performance, here&#x27;s a preview:<p><a href="https:&#x2F;&#x2F;docs.google.com&#x2F;document&#x2F;d&#x2F;1xFoRjb7pn4ZtL5BH7_ZwXNgNpSCLPiYAIQ1BcSalY9w&#x2F;edit?usp=sharing" rel="nofollow">https:&#x2F;&#x2F;docs.google.com&#x2F;document&#x2F;d&#x2F;1xFoRjb7pn4ZtL5BH7_ZwXNgN...</a>
c0l04 天前
Wow... reading this article in full really made me lose hope in OpenSSL, the project and the library.<p>I was well aware of the expected inconveniences any new major OpenSSL release would trigger (esp. older, less actively maintained applications having to adapt their API usage to keep working) going in, but what the linked github issue&#x2F;PR comments hint at is just... mental.<p>As best illustrated by <a href="https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;issues&#x2F;20286#issuecomment-1547053752">https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;issues&#x2F;20286#issuecomment...</a> not only seem the core developers not care about runtime performance at all, they also seem to have a completely absurd perception of their own project, esp. in relation to other, <i>genuinely</i> small FOSS projects.<p>It&#x27;s just wild. I hope this can still be turned around, and OpenSSL can somehow re-emerge from this clusterfuck as the stable bedrock of web transport security that we learned to rely on from 2014 onwards.
评论 #43958749 未加载
评论 #43955213 未加载
评论 #43955517 未加载
评论 #43956637 未加载
评论 #43952784 未加载
pixelesque4 天前
I&#x27;ve been working on a project of mine which makes web requests via libCURL, and the number of memory allocations OpenSSL makes for a single TLS connection is astonishing - running it through `heaptrack` was a real eye-opener.<p>Discussion I found about other people mentioning it:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;discussions&#x2F;26659">https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;discussions&#x2F;26659</a><p>In some cases (not all) for my workflows perf record traces show the allocation &#x2F; deallocation overhead is quite significant, especially in a multi-threaded setup, where contention against the system allocator starts to become a problem in some situations.
评论 #43951396 未加载
评论 #43960975 未加载
dur-randir4 天前
For anyone wondering, have fun reading responses to those:<p>- <a href="https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;issues&#x2F;20286">https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;issues&#x2F;20286</a><p>- <a href="https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;issues&#x2F;18814">https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;issues&#x2F;18814</a><p>- <a href="https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;issues&#x2F;16791">https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;issues&#x2F;16791</a><p>- <a href="https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;issues&#x2F;17950">https:&#x2F;&#x2F;github.com&#x2F;openssl&#x2F;openssl&#x2F;issues&#x2F;17950</a>
kccqzy4 天前
I have no idea this happened, but after reading this article my main takeaway was that OpenSSL shot themselves in the foot. Is this a fair assessment? I mean the excessive locking just stands out to be ill-advised for this performance-sensitive piece of code.
评论 #43953020 未加载
2bluesc4 天前
Never heard of aws-lc before this, but now I&#x27;m looking for an excuse to use it.
评论 #43952233 未加载
评论 #43962832 未加载
drob5183 天前
Well, that was an extremely thorough and well-documented take down of OpenSSL’s issues, both technical and organizational. The OpenSSL team should be embarrassed. What’s your side of the story, OpenSSL?
DyslexicAtheist4 天前
<i>&gt; Modern implementations must support a range of TLS protocol versions (from legacy TLS 1.0 to current TLS 1.3)</i><p>So this statement is strange considering &quot;modern&quot; security standards either nudge you (or demand) to deprecate anything that isn&#x27;t v1.3 or v1.2.<p>If the implementation is &quot;modern&quot; why would I allow 1.0 ?<p>This seems like a HA-Proxy problem. They ought to maintain support for geriatric TLS versions on a dedicated release branch connected to a support-model that nudges their client into updating by increasing their fees for maintaining that system. Not doing so means the vendor is part of the problem why we have slower adoption rates for 1.3 than we could otherwise have.<p>It would have been cool to see AWS&#x27;s s2n-tls (or s2n-quic <a href="https:&#x2F;&#x2F;github.com&#x2F;aws&#x2F;s2n-quic">https:&#x2F;&#x2F;github.com&#x2F;aws&#x2F;s2n-quic</a>) included in their benchmark.<p>One of my all time favorite episode from the SCW podcast goes into the design decisions of s2n:<p><i>The feeling&#x27;s mutual: mTLS with Colm MacCárthaigh</i> <a href="https:&#x2F;&#x2F;securitycryptographywhatever.com&#x2F;2021&#x2F;12&#x2F;29&#x2F;the-feeling-s-mutual-mtls-with-colm-maccarthaigh&#x2F;" rel="nofollow">https:&#x2F;&#x2F;securitycryptographywhatever.com&#x2F;2021&#x2F;12&#x2F;29&#x2F;the-feel...</a><p>From AWS: <a href="https:&#x2F;&#x2F;aws.amazon.com&#x2F;security&#x2F;opensource&#x2F;cryptography&#x2F;" rel="nofollow">https:&#x2F;&#x2F;aws.amazon.com&#x2F;security&#x2F;opensource&#x2F;cryptography&#x2F;</a><p><i>&gt; &quot;In 2015, AWS introduced s2n-tls, a fast open source implementation of the TLS protocol. The name &quot;s2n&quot;, or &quot;signal to noise,&quot; refers to the way encryption masks meaningful signals behind a facade of seemingly random noise. Since then, AWS has launched several other open source cryptographic libraries, including Amazon Corretto Crypto Provider (ACCP) and AWS Libcrypto (AWS-LC). AWS believes that open source benefits everyone, and we are committed to expanding our cryptographic and transport libraries to meet the evolving security needs of our customers.&quot;</i><p>Here is a pdf that provides some performance results for s2n (sadly not s2n-quic):<p><i>&quot;Performance Analysis of SSL&#x2F;TLS Crypto Libraries: Based on Operating Platform&quot;</i> <a href="https:&#x2F;&#x2F;bhu.ac.in&#x2F;research_pub&#x2F;jsr&#x2F;Volumes&#x2F;JSR_66_02_2022&#x2F;12.pdf" rel="nofollow">https:&#x2F;&#x2F;bhu.ac.in&#x2F;research_pub&#x2F;jsr&#x2F;Volumes&#x2F;JSR_66_02_2022&#x2F;12...</a>
评论 #43953589 未加载
评论 #43955827 未加载
评论 #43953043 未加载
评论 #43955625 未加载
jedisct13 天前
Official OpenSSL benchmarks: <a href="https:&#x2F;&#x2F;openssl-library.org&#x2F;performance.html" rel="nofollow">https:&#x2F;&#x2F;openssl-library.org&#x2F;performance.html</a><p>OpenSSL 3.0 was catastrophic, but it looks like OpenSSL 3.5 isn&#x27;t too bad.
评论 #43966127 未加载
评论 #43962954 未加载
jeffbee3 天前
It seems weird to disqualify boringssl due to live-at-head project philosophy. Obviously _your_ project doesn&#x27;t have to change every time boringssl changes.
评论 #43954694 未加载
评论 #43957663 未加载
toast04 天前
&gt; Roman Arutyunyan from NGINX core team were the first to propose a solution with a clever method that abuses the keylog callback to make it possible to extract or inject the required elements, and finally make it possible to have a minimal server-mode QUIC support.<p>This sounds like future pain waiting to happen. My experience with callbacks in Openssl 1.0.x is that letter releases may significantly alter or remove callbacks. In the long term, I guess it worked out, because I figured out a better way to do what I was trying to do and got it accepted into OpenSSL and that fixed things for everyone, but in the short term it was a PITA and I&#x27;d have to decide between out of date OpenSSL with my feature working and updating OpenSSL to address whatever security problem of the day but my feature not working while I take a week to figure out how to do it in the new world.<p>In my case, the feature was doing DHE-RSA with Microsoft Schannel and not causing an &#x27;out of memory&#x27; error on the client when the server public key has 8 or more bits of zeros at the high end. The client didn&#x27;t actually run out of memory, but that was the error it reported.<p>Multithreading can be hard; when I had a problem for HAProxy to solve, 1.8 was just out and using multiple processes was much better for my application than threads. Configuration for multiple processes was more difficult, of course, but one time pain in order to get many multiples of throughput was worth it (and I didn&#x27;t need any shared state between processes, so I didn&#x27;t lose functionality... not everyone has that liberty) But I gather multithreaded HAProxy has gotten a lot better; and my problem went away and anyway I left the company whose problem I was solving with HAProxy anyway; so I don&#x27;t have current knowledge. But the description of OpenSSL is describing a multithreading nightmare:<p>&gt; With OpenSSL 3.0, an important goal was apparently to make the library much more dynamic, with a lot of previously constant elements (e.g., algorithm identifiers, etc.) becoming dynamic and having to be looked up in a list instead of being fixed at compile-time. Since the new design allows anyone to update that list at runtime, locks were placed everywhere when accessing the list to ensure consistency. These lists are apparently scanned to find very basic configuration elements, so this operation is performed a lot.<p>I&#x27;m not sure this kind of thing needs to be a fixed list at compile time (although it has worked for decades, yeah?); having a way to load a config and fixing the config before sharing it would be a good way to avoid the need for locking. If it does need to be changable at runtime, it can still be done with performance... an instance of configuration should be immutable, then you can have a shared pointer to the current config. At critical points, you might copy the current pointer or something. There&#x27;s techniques and prior art for this kind of stuff.
评论 #43954275 未加载
Ros233 天前
LibreSSL is the answer.
yencabulator3 天前
The State of <i>C</i> SSL Stacks