Re: [C++] Time to sign

[Berin Lautenbach <be...@wingsofhermes.org>]

Samuel,

The encryption function within OpenSSL calls a blinding function to 
randomise the amount of time spent in the crypto operation.  Within that 
function it calls on the random generator to get some random bits.

What platform are you on?  I wonder if the generator has not been seeded 
properly for some reason?

Do you have a debug version of openssl that you can trace down to 
exactly where the time is?

Cheers,
	Berin


GRU Samuel wrote:

> Hi  Berin,
> 
> I have traced the process and all time is being spent in the 
> RSA_private_encrypt function called in 
> OpenSSLCryptoKeyRSA::signSHA1PKCS1Base64Signature(..)
> Has you got an idea ?
> 
> Samuel.
> 
> GRU Samuel a écrit :
> 
>> I don't trace the process for the moment (i don't have the time, i 
>> have an over bug  in a other part of my code :-(  )
>> but i do this and i had this result :
>> - The first time i called  "sign()" after i launched apache : ~1 s the 
>> first time and ~0.1 s after (in the same process)
>> - After when i called it :  the time increased each time !  (~1, 4s 
>> ->... -> ~2s->........->~15s->...)
>> - And when i stop and restart apache , the new first time : ~1s
>>
>> I will tell you when i  will trace the process !
>>
>> Samuel.
>>
>> Berin Lautenbach a écrit :
>>
>>> Samuel,
>>>
>>> 15 seconds is a long time!  It would be interesting to know where the 
>>> time is being spent.  Are you able to trace the process?
>>>
>>> I am assuming you are calling sign() multiple times from the same 
>>> process?
>>>
>>> Cheers,
>>>     Berin
>>>
>>> GRU Samuel wrote:
>>>
>>>> Hi,
>>>>
>>>> First, i work on Windows 2000 and i used VC7 to compile the library.
>>>> I use the security library to sign my XML but i have a problem of  
>>>> when i call the sign() method.
>>>> I use it with OpenSSL, and i used RSA.
>>>>
>>>> In a application, the first time, i spend 1 second in it. After, 
>>>> just 0,01 second
>>>> In a DLL (a web service with apache), the first time, i spend 15-20 
>>>> seconds in it. After, just 0,01 second
>>>>
>>>> It is too much. ;-)
>>>> Why? And Why the difference ?
>>>>
>>>>
>>>> Samuel Gru
>>>>
>>>>
>>>>
>>
>>
> 
> 
> 
> 

Re: [C++] Time to sign

[Erwin van der Koogh <vd...@apache.org>]

>  From the previous correspondance it's actually increasing in time over
> multiple signs.  Which almost sounds like a /dev/random blocking until it
> has enough entropy to provide some bits?

That'll teach me to even (especially?) read up on C++ threads before 
putting in a couple cents :-)

There are 2 /dev/randoms on Linux (and maybe on other platforms as well) 
one is called /dev/random and one is /dev/urandom. /dev/random is the true 
random number generator, which does block waiting for more bits to come 
along. /dev/urandom is a pseudo random number generator which frequently 
reseeds itself from /dev/random.
So if /dev/random is the only source of randomness for openssl then it's 
definately possible that that's happening.
If you can configure this somewhere.. try setting it to /dev/urandom (if on 
Linux) and see if that solves your problems.

> Of course there are other things it could be as well, so I'm just putting
> theories at the moment :>.

waiting for /dev/random seems a plausible theorie at the moment.

Erwin

Re: [C++] Time to sign

[Berin Lautenbach <be...@wingsofhermes.org>]

Erwin,

 From the previous correspondance it's actually increasing in time over 
multiple signs.  Which almost sounds like a /dev/random blocking until 
it has enough entropy to provide some bits?

Of course there are other things it could be as well, so I'm just 
putting theories at the moment :>.

Cheers,
	Berin


Erwin van der Koogh wrote:

>> What platform are you on?  I wonder if the generator has not been seeded
>> properly for some reason?
> 
> 
> I am not an openssl guru, but in most other cryptographic toolkits I 
> have seen it should make a big difference between the first and 
> subsequent signs if this is the case.
> 
> Does it happen to other signs after the first?
> 
> Erwin
> 
> 
> 
> 

Re: [C++] Time to sign

[Erwin van der Koogh <vd...@apache.org>]

> What platform are you on?  I wonder if the generator has not been seeded
> properly for some reason?

I am not an openssl guru, but in most other cryptographic toolkits I have 
seen it should make a big difference between the first and subsequent signs 
if this is the case.

Does it happen to other signs after the first?

Erwin