You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@santuario.apache.org by Scott Cantor <ca...@osu.edu> on 2004/03/02 02:21:39 UTC
RE: Id vs. id
> 2. Allowable names for Id attributes are now stored in a list. This
> list can be added to by the calling program using new methods on
> DSIGSignature.
I like this. It lets you work around situations where you don't have DOM3
support, in Java especially.
> As an aside, the DSIGSignature class is getting rather ugly, with calls
> all over the place to enable and disable functionality. I am thinking
> of introducing a set of methods in 1.2 that will provide a consistant,
> single interface for all configuration on DSIGSignature, as this will
> provide better portability. I'll also add the interface to XSECProvider
> to allow for "global" configurations. Half the work was done for 1.1 in
> that there is now an "environment" object that holds all this
> information and gets passed around the various signature objects.
>
> Interested in thoughts on the last part.
Seems like a good idea to me. I'm not working off of that modified code yet
(using 1.0) so I can't comment specifically on the environment object, but
that seems like a reasonable way to provide options to the signature
wrapper.
-- Scott
Re: [C++] Time to sign
Posted by Erwin van der Koogh <vd...@apache.org>.
> From the previous correspondance it's actually increasing in time over
> multiple signs. Which almost sounds like a /dev/random blocking until it
> has enough entropy to provide some bits?
That'll teach me to even (especially?) read up on C++ threads before
putting in a couple cents :-)
There are 2 /dev/randoms on Linux (and maybe on other platforms as well)
one is called /dev/random and one is /dev/urandom. /dev/random is the true
random number generator, which does block waiting for more bits to come
along. /dev/urandom is a pseudo random number generator which frequently
reseeds itself from /dev/random.
So if /dev/random is the only source of randomness for openssl then it's
definately possible that that's happening.
If you can configure this somewhere.. try setting it to /dev/urandom (if on
Linux) and see if that solves your problems.
> Of course there are other things it could be as well, so I'm just putting
> theories at the moment :>.
waiting for /dev/random seems a plausible theorie at the moment.
Erwin
Re: [C++] Time to sign
Posted by Berin Lautenbach <be...@wingsofhermes.org>.
Erwin,
From the previous correspondance it's actually increasing in time over
multiple signs. Which almost sounds like a /dev/random blocking until
it has enough entropy to provide some bits?
Of course there are other things it could be as well, so I'm just
putting theories at the moment :>.
Cheers,
Berin
Erwin van der Koogh wrote:
>> What platform are you on? I wonder if the generator has not been seeded
>> properly for some reason?
>
>
> I am not an openssl guru, but in most other cryptographic toolkits I
> have seen it should make a big difference between the first and
> subsequent signs if this is the case.
>
> Does it happen to other signs after the first?
>
> Erwin
>
>
>
>
Re: [C++] Time to sign
Posted by Erwin van der Koogh <vd...@apache.org>.
> What platform are you on? I wonder if the generator has not been seeded
> properly for some reason?
I am not an openssl guru, but in most other cryptographic toolkits I have
seen it should make a big difference between the first and subsequent signs
if this is the case.
Does it happen to other signs after the first?
Erwin
Re: [C++] Time to sign
Posted by Berin Lautenbach <be...@wingsofhermes.org>.
Samuel,
The encryption function within OpenSSL calls a blinding function to
randomise the amount of time spent in the crypto operation. Within that
function it calls on the random generator to get some random bits.
What platform are you on? I wonder if the generator has not been seeded
properly for some reason?
Do you have a debug version of openssl that you can trace down to
exactly where the time is?
Cheers,
Berin
GRU Samuel wrote:
> Hi Berin,
>
> I have traced the process and all time is being spent in the
> RSA_private_encrypt function called in
> OpenSSLCryptoKeyRSA::signSHA1PKCS1Base64Signature(..)
> Has you got an idea ?
>
> Samuel.
>
> GRU Samuel a écrit :
>
>> I don't trace the process for the moment (i don't have the time, i
>> have an over bug in a other part of my code :-( )
>> but i do this and i had this result :
>> - The first time i called "sign()" after i launched apache : ~1 s the
>> first time and ~0.1 s after (in the same process)
>> - After when i called it : the time increased each time ! (~1, 4s
>> ->... -> ~2s->........->~15s->...)
>> - And when i stop and restart apache , the new first time : ~1s
>>
>> I will tell you when i will trace the process !
>>
>> Samuel.
>>
>> Berin Lautenbach a écrit :
>>
>>> Samuel,
>>>
>>> 15 seconds is a long time! It would be interesting to know where the
>>> time is being spent. Are you able to trace the process?
>>>
>>> I am assuming you are calling sign() multiple times from the same
>>> process?
>>>
>>> Cheers,
>>> Berin
>>>
>>> GRU Samuel wrote:
>>>
>>>> Hi,
>>>>
>>>> First, i work on Windows 2000 and i used VC7 to compile the library.
>>>> I use the security library to sign my XML but i have a problem of
>>>> when i call the sign() method.
>>>> I use it with OpenSSL, and i used RSA.
>>>>
>>>> In a application, the first time, i spend 1 second in it. After,
>>>> just 0,01 second
>>>> In a DLL (a web service with apache), the first time, i spend 15-20
>>>> seconds in it. After, just 0,01 second
>>>>
>>>> It is too much. ;-)
>>>> Why? And Why the difference ?
>>>>
>>>>
>>>> Samuel Gru
>>>>
>>>>
>>>>
>>
>>
>
>
>
>
Re: [C++] Time to sign
Posted by GRU Samuel <sa...@crf.canon.fr>.
Hi Berin,
I have traced the process and all time is being spent in the
RSA_private_encrypt function called in
OpenSSLCryptoKeyRSA::signSHA1PKCS1Base64Signature(..)
Has you got an idea ?
Samuel.
GRU Samuel a écrit :
> I don't trace the process for the moment (i don't have the time, i
> have an over bug in a other part of my code :-( )
> but i do this and i had this result :
> - The first time i called "sign()" after i launched apache : ~1 s the
> first time and ~0.1 s after (in the same process)
> - After when i called it : the time increased each time ! (~1, 4s
> ->... -> ~2s->........->~15s->...)
> - And when i stop and restart apache , the new first time : ~1s
>
> I will tell you when i will trace the process !
>
> Samuel.
>
> Berin Lautenbach a écrit :
>
>> Samuel,
>>
>> 15 seconds is a long time! It would be interesting to know where the
>> time is being spent. Are you able to trace the process?
>>
>> I am assuming you are calling sign() multiple times from the same
>> process?
>>
>> Cheers,
>> Berin
>>
>> GRU Samuel wrote:
>>
>>> Hi,
>>>
>>> First, i work on Windows 2000 and i used VC7 to compile the library.
>>> I use the security library to sign my XML but i have a problem of
>>> when i call the sign() method.
>>> I use it with OpenSSL, and i used RSA.
>>>
>>> In a application, the first time, i spend 1 second in it. After,
>>> just 0,01 second
>>> In a DLL (a web service with apache), the first time, i spend 15-20
>>> seconds in it. After, just 0,01 second
>>>
>>> It is too much. ;-)
>>> Why? And Why the difference ?
>>>
>>>
>>> Samuel Gru
>>>
>>>
>>>
>
>
Re: [C++]
Posted by Berin Lautenbach <be...@wingsofhermes.org>.
I don't like the sound of that. It sounds most strange. Let me know
how you go!
Cheers,
Berin
GRU Samuel wrote:
> I don't trace the process for the moment (i don't have the time, i have
> an over bug in a other part of my code :-( )
> but i do this and i had this result :
> - The first time i called "sign()" after i launched apache : ~1 s the
> first time and ~0.1 s after (in the same process)
> - After when i called it : the time increased each time ! (~1, 4s
> ->... -> ~2s->........->~15s->...)
> - And when i stop and restart apache , the new first time : ~1s
>
> I will tell you when i will trace the process !
>
> Samuel.
>
> Berin Lautenbach a écrit :
>
>> Samuel,
>>
>> 15 seconds is a long time! It would be interesting to know where the
>> time is being spent. Are you able to trace the process?
>>
>> I am assuming you are calling sign() multiple times from the same
>> process?
>>
>> Cheers,
>> Berin
>>
>> GRU Samuel wrote:
>>
>>> Hi,
>>>
>>> First, i work on Windows 2000 and i used VC7 to compile the library.
>>> I use the security library to sign my XML but i have a problem of
>>> when i call the sign() method.
>>> I use it with OpenSSL, and i used RSA.
>>>
>>> In a application, the first time, i spend 1 second in it. After, just
>>> 0,01 second
>>> In a DLL (a web service with apache), the first time, i spend 15-20
>>> seconds in it. After, just 0,01 second
>>>
>>> It is too much. ;-)
>>> Why? And Why the difference ?
>>>
>>>
>>> Samuel Gru
>>>
>>>
>>>
>
>
>
>
Re: [C++]
Posted by GRU Samuel <sa...@crf.canon.fr>.
I don't trace the process for the moment (i don't have the time, i have
an over bug in a other part of my code :-( )
but i do this and i had this result :
- The first time i called "sign()" after i launched apache : ~1 s the
first time and ~0.1 s after (in the same process)
- After when i called it : the time increased each time ! (~1, 4s
->... -> ~2s->........->~15s->...)
- And when i stop and restart apache , the new first time : ~1s
I will tell you when i will trace the process !
Samuel.
Berin Lautenbach a écrit :
> Samuel,
>
> 15 seconds is a long time! It would be interesting to know where the
> time is being spent. Are you able to trace the process?
>
> I am assuming you are calling sign() multiple times from the same
> process?
>
> Cheers,
> Berin
>
> GRU Samuel wrote:
>
>> Hi,
>>
>> First, i work on Windows 2000 and i used VC7 to compile the library.
>> I use the security library to sign my XML but i have a problem of
>> when i call the sign() method.
>> I use it with OpenSSL, and i used RSA.
>>
>> In a application, the first time, i spend 1 second in it. After, just
>> 0,01 second
>> In a DLL (a web service with apache), the first time, i spend 15-20
>> seconds in it. After, just 0,01 second
>>
>> It is too much. ;-)
>> Why? And Why the difference ?
>>
>>
>> Samuel Gru
>>
>>
>>
Re: [C++]
Posted by Berin Lautenbach <be...@wingsofhermes.org>.
Samuel,
15 seconds is a long time! It would be interesting to know where the
time is being spent. Are you able to trace the process?
I am assuming you are calling sign() multiple times from the same process?
Cheers,
Berin
GRU Samuel wrote:
> Hi,
>
> First, i work on Windows 2000 and i used VC7 to compile the library.
> I use the security library to sign my XML but i have a problem of when
> i call the sign() method.
> I use it with OpenSSL, and i used RSA.
>
> In a application, the first time, i spend 1 second in it. After, just
> 0,01 second
> In a DLL (a web service with apache), the first time, i spend 15-20
> seconds in it. After, just 0,01 second
>
> It is too much. ;-)
> Why? And Why the difference ?
>
>
> Samuel Gru
>
>
>
[C++]
Posted by GRU Samuel <sa...@crf.canon.fr>.
Hi,
First, i work on Windows 2000 and i used VC7 to compile the library.
I use the security library to sign my XML but i have a problem of when
i call the sign() method.
I use it with OpenSSL, and i used RSA.
In a application, the first time, i spend 1 second in it. After, just
0,01 second
In a DLL (a web service with apache), the first time, i spend 15-20
seconds in it. After, just 0,01 second
It is too much. ;-)
Why? And Why the difference ?
Samuel Gru
RE: Id vs. id
Posted by Scott Cantor <ca...@osu.edu>.
> Would it be useful to have the ability to have name based Id searching
> turned off?
In a release, yes, I would probably turn it off. I probably wouldn't be
relying on anything until it's officially out, so there's no need to rush
anything in on my account.
-- Scott
RE: Id vs. id
Posted by Berin Lautenbach <be...@wingsofhermes.org>.
>> Given the Java library is unlikely to happen this weekend (unless
>> people help - hint hint :>), do people think we should try to get this
>> ID handling functionality into it prior to a release?
>
> I'm agnostic, since I don't generally rely on unreleased functionality.
> I'm already using DOM3 calls for now anyway.
Would it be useful to have the ability to have name based Id searching
turned off?
Cheers,
Berin
RE: Id vs. id
Posted by Scott Cantor <ca...@osu.edu>.
> Given the Java library is unlikely to happen this weekend (unless people
> help - hint hint :>), do people think we should try to get this ID
> handling functionality into it prior to a release?
I'm agnostic, since I don't generally rely on unreleased functionality. I'm
already using DOM3 calls for now anyway.
> Also (and the reason I have hesitated on the Java side), should the
> configuration be done programatically or via the config.xml file? My gut
> feeling is both - set the default in config.xml and provide some methods
> on XMLSignature to allow an over-ride, similar to the C++ library.
>
> However I'm not the Java expert that others on this list are, so
> interested in thoughts :>.
Well, that's probably the most consistent with the overall approach. The
Java expertise I have at my disposal is generally disturbed by that
config.xml file anyway. ;-)
-- Scott
RE: Id vs. id
Posted by Berin Lautenbach <be...@wingsofhermes.org>.
>> 2. Allowable names for Id attributes are now stored in a list. This
>> list can be added to by the calling program using new methods on
>> DSIGSignature.
>
> I like this. It lets you work around situations where you don't have
> DOM3 support, in Java especially.
Which is a good point. I have only done this for the C++ library.
I am still on track to get v1.1 of the C++ library out this weekend, but
things are not looking good for the Java library.
Given the Java library is unlikely to happen this weekend (unless people
help - hint hint :>), do people think we should try to get this ID
handling functionality into it prior to a release?
Also (and the reason I have hesitated on the Java side), should the
configuration be done programatically or via the config.xml file? My gut
feeling is both - set the default in config.xml and provide some methods
on XMLSignature to allow an over-ride, similar to the C++ library.
However I'm not the Java expert that others on this list are, so
interested in thoughts :>.
Cheers,
Berin