Reg slowness seen in openssl 1.1.1

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
11 messages Options
Reply | Threaded
Open this post in threaded view
|

Reg slowness seen in openssl 1.1.1

ramakrushna mishra
Hi, 

When we use following set of SSL methods ( openssl 1.1.1)  for SHA1-digest, we are witnessing slowness compared to  openssl 1.1.0e. 

EVP_get_digestbyname
EVP_MD_CTX_new
EVP_DigestInit_ex
EVP_DigestUpdate
EVP_DigestFinal_ex

Could anyone please guide me about how to debug this issue. 

Thanks and Regards,
Ram Krushna
Reply | Threaded
Open this post in threaded view
|

Re: Reg slowness seen in openssl 1.1.1

OpenSSL - User mailing list

I would start with doing profiling on old and new versions to see where the slowdown is.

Reply | Threaded
Open this post in threaded view
|

Re: Reg slowness seen in openssl 1.1.1

ramakrushna mishra
Hi,

Thank you for the response. 
If we compare in quantify attached is the results. 

Thanks and Regards,
Ram Krushna

On Thu, May 9, 2019 at 8:28 PM Salz, Rich <[hidden email]> wrote:

I would start with doing profiling on old and new versions to see where the slowdown is.


Quantify_qv_Diff.txt (28K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Reg slowness seen in openssl 1.1.1

OpenSSL - User mailing list

So now you know where to start looking, I guess.  You might also change your test program so that it calls the functions multiple times, to “smooth out” the overhead.

Reply | Threaded
Open this post in threaded view
|

Re: Reg slowness seen in openssl 1.1.1

ramakrushna mishra
Hi ,

I can observe slowness with standalone c programs.  Attached are the sample c programs. 
If I run them with openssl 1.1.1 and 1.1.0e version on Linux system (Linux 2.6.32-504.el6.x86_64 x86_64
). then I can see the difference. If I increase the number of loop in the program, then the slowness increases. 

Could you please look into the program and let me know if anything  I am doing wrong ? 
Or else What could be the issue ? 

Thanks and Regards,
Ram Krushna

On Thu, May 9, 2019 at 8:43 PM Salz, Rich <[hidden email]> wrote:

So now you know where to start looking, I guess.  You might also change your test program so that it calls the functions multiple times, to “smooth out” the overhead.


encdec.c (1K) Download Attachment
digest.c (1K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Reg slowness seen in openssl 1.1.1

OpenSSL - User mailing list

>  Could you please look into the program and let me know if anything  I am doing wrong ? 

> Or else What could be the issue ? 

 

Sorry, no not me.  Maybe someone else on the list has ideas.

Reply | Threaded
Open this post in threaded view
|

Re: Reg slowness seen in openssl 1.1.1

ramakrushna mishra
Hi,

Could anyone please help me wth it.

Following are sslc speed results for SHA1.

sslc speed sha1
Doing sha1 for 3s on 16 size blocks: 16858430 sha1's in 2.98s
Doing sha1 for 3s on 64 size blocks: 14147528 sha1's in 3.00s
Doing sha1 for 3s on 256 size blocks: 6436755 sha1's in 2.99s
Doing sha1 for 3s on 1024 size blocks: 2055335 sha1's in 3.00s
Doing sha1 for 3s on 8192 size blocks: 266404 sha1's in 2.99s
Doing sha1 for 3s on 16384 size blocks: 152376 sha1's in 3.00s
OpenSSL 1.1.0e  16 Feb 2017
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr)
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DOPENSSLDIR="\"/vobs_prgs/tools/linuxx86_64/openssl/install\"" -DENGINESDIR="\"/vobs_prgs/tools/linuxx86_64/openssl/install/lib/engines-1.1\""
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
sha1             90515.06k   301813.93k   551106.78k   701554.35k   729893.50k   832176.13k



sslc speed sha1
Doing sha1 for 3s on 16 size blocks: 16939397 sha1's in 2.99s
Doing sha1 for 3s on 64 size blocks: 11489920 sha1's in 3.00s
Doing sha1 for 3s on 256 size blocks: 5316410 sha1's in 2.99s
Doing sha1 for 3s on 1024 size blocks: 2006834 sha1's in 3.00s
Doing sha1 for 3s on 8192 size blocks: 273661 sha1's in 2.98s
Doing sha1 for 3s on 16384 size blocks: 150159 sha1's in 2.99s
OpenSSL 1.1.1  11 Sep 2018
built on: Tue Feb 12 18:18:22 2019 UTC
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -fPIC -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DNDEBUG -fPIC
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
sha1             90645.60k   245118.29k   455184.27k   684999.34k   752292.25k   822811.06k

Does not this  means 1.1.1 process lesser number of bytes per second compared to 1.1.0e ?

Thanks and Regards,
Ram Krushna 

On Thu, May 9, 2019 at 11:46 PM Salz, Rich <[hidden email]> wrote:

>  Could you please look into the program and let me know if anything  I am doing wrong ? 

> Or else What could be the issue ? 

 

Sorry, no not me.  Maybe someone else on the list has ideas.

Reply | Threaded
Open this post in threaded view
|

Re: Reg slowness seen in openssl 1.1.1

ramakrushna mishra
Hi ,

The results on a AIX machine looks more bad If I am interpreting them correctly.

openssl 1.1.0e : 
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
sha1             65019.16k   151552.49k   266107.41k   337113.93k   360792.93k   364102.89k


openssl 1.1.1 : 
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
sha1             10641.28k    21433.09k    38464.85k    48496.92k    49381.38k    51755.48k

could any one please confirm if my interpretation is correct ? 
I doubt any issue with openssl 1.1.1 version with such wider user base. 
How to debug this further ? 

Thanks and Regards,
Ram Krushna


On Fri, May 10, 2019 at 5:59 AM ramakrushna mishra <[hidden email]> wrote:
Hi,

Could anyone please help me wth it.

Following are sslc speed results for SHA1.

sslc speed sha1
Doing sha1 for 3s on 16 size blocks: 16858430 sha1's in 2.98s
Doing sha1 for 3s on 64 size blocks: 14147528 sha1's in 3.00s
Doing sha1 for 3s on 256 size blocks: 6436755 sha1's in 2.99s
Doing sha1 for 3s on 1024 size blocks: 2055335 sha1's in 3.00s
Doing sha1 for 3s on 8192 size blocks: 266404 sha1's in 2.99s
Doing sha1 for 3s on 16384 size blocks: 152376 sha1's in 3.00s
OpenSSL 1.1.0e  16 Feb 2017
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr)
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DOPENSSLDIR="\"/vobs_prgs/tools/linuxx86_64/openssl/install\"" -DENGINESDIR="\"/vobs_prgs/tools/linuxx86_64/openssl/install/lib/engines-1.1\""
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
sha1             90515.06k   301813.93k   551106.78k   701554.35k   729893.50k   832176.13k



sslc speed sha1
Doing sha1 for 3s on 16 size blocks: 16939397 sha1's in 2.99s
Doing sha1 for 3s on 64 size blocks: 11489920 sha1's in 3.00s
Doing sha1 for 3s on 256 size blocks: 5316410 sha1's in 2.99s
Doing sha1 for 3s on 1024 size blocks: 2006834 sha1's in 3.00s
Doing sha1 for 3s on 8192 size blocks: 273661 sha1's in 2.98s
Doing sha1 for 3s on 16384 size blocks: 150159 sha1's in 2.99s
OpenSSL 1.1.1  11 Sep 2018
built on: Tue Feb 12 18:18:22 2019 UTC
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -fPIC -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DNDEBUG -fPIC
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
sha1             90645.60k   245118.29k   455184.27k   684999.34k   752292.25k   822811.06k

Does not this  means 1.1.1 process lesser number of bytes per second compared to 1.1.0e ?

Thanks and Regards,
Ram Krushna 

On Thu, May 9, 2019 at 11:46 PM Salz, Rich <[hidden email]> wrote:

>  Could you please look into the program and let me know if anything  I am doing wrong ? 

> Or else What could be the issue ? 

 

Sorry, no not me.  Maybe someone else on the list has ideas.

Reply | Threaded
Open this post in threaded view
|

Re: Reg slowness seen in openssl 1.1.1

ramakrushna mishra
Hi ,

I have installed openssl from scratch and there I am not observing any degradation.  But I built it with in my project, there I observe the degradation.  The Configure file remains same , but still in my project I can see a difference that "dynamic-engine" is present in enabled feature list. 

But In Configure file its present in disabled list. So, Could anyone suggest how this can be disabled ? 
And I want to build the openssl outside my project) with dynamic-engine enabled. What Configure argument shall i pass or make changes in Configure file to achive that ? 

Thanks and Regards,
Ram Krushna

On Fri, May 10, 2019 at 6:46 AM ramakrushna mishra <[hidden email]> wrote:
Hi ,

The results on a AIX machine looks more bad If I am interpreting them correctly.

openssl 1.1.0e : 
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
sha1             65019.16k   151552.49k   266107.41k   337113.93k   360792.93k   364102.89k


openssl 1.1.1 : 
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
sha1             10641.28k    21433.09k    38464.85k    48496.92k    49381.38k    51755.48k

could any one please confirm if my interpretation is correct ? 
I doubt any issue with openssl 1.1.1 version with such wider user base. 
How to debug this further ? 

Thanks and Regards,
Ram Krushna


On Fri, May 10, 2019 at 5:59 AM ramakrushna mishra <[hidden email]> wrote:
Hi,

Could anyone please help me wth it.

Following are sslc speed results for SHA1.

sslc speed sha1
Doing sha1 for 3s on 16 size blocks: 16858430 sha1's in 2.98s
Doing sha1 for 3s on 64 size blocks: 14147528 sha1's in 3.00s
Doing sha1 for 3s on 256 size blocks: 6436755 sha1's in 2.99s
Doing sha1 for 3s on 1024 size blocks: 2055335 sha1's in 3.00s
Doing sha1 for 3s on 8192 size blocks: 266404 sha1's in 2.99s
Doing sha1 for 3s on 16384 size blocks: 152376 sha1's in 3.00s
OpenSSL 1.1.0e  16 Feb 2017
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr)
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DOPENSSLDIR="\"/vobs_prgs/tools/linuxx86_64/openssl/install\"" -DENGINESDIR="\"/vobs_prgs/tools/linuxx86_64/openssl/install/lib/engines-1.1\""
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
sha1             90515.06k   301813.93k   551106.78k   701554.35k   729893.50k   832176.13k



sslc speed sha1
Doing sha1 for 3s on 16 size blocks: 16939397 sha1's in 2.99s
Doing sha1 for 3s on 64 size blocks: 11489920 sha1's in 3.00s
Doing sha1 for 3s on 256 size blocks: 5316410 sha1's in 2.99s
Doing sha1 for 3s on 1024 size blocks: 2006834 sha1's in 3.00s
Doing sha1 for 3s on 8192 size blocks: 273661 sha1's in 2.98s
Doing sha1 for 3s on 16384 size blocks: 150159 sha1's in 2.99s
OpenSSL 1.1.1  11 Sep 2018
built on: Tue Feb 12 18:18:22 2019 UTC
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -fPIC -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DNDEBUG -fPIC
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
sha1             90645.60k   245118.29k   455184.27k   684999.34k   752292.25k   822811.06k

Does not this  means 1.1.1 process lesser number of bytes per second compared to 1.1.0e ?

Thanks and Regards,
Ram Krushna 

On Thu, May 9, 2019 at 11:46 PM Salz, Rich <[hidden email]> wrote:

>  Could you please look into the program and let me know if anything  I am doing wrong ? 

> Or else What could be the issue ? 

 

Sorry, no not me.  Maybe someone else on the list has ideas.

Reply | Threaded
Open this post in threaded view
|

Re: Reg slowness seen in openssl 1.1.1

Jan Just Keijser-2
In reply to this post by ramakrushna mishra
Hi,

On 10/05/19 02:29, ramakrushna mishra wrote:

> Hi,
>
> Could anyone please help me wth it.
>
> Following are sslc speed results for SHA1.
>
> [...]
> OpenSSL 1.1.0e  16 Feb 2017
> type             16 bytes     64 bytes    256 bytes   1024 bytes 
>  8192 bytes  16384 bytes
> sha1             90515.06k   301813.93k   551106.78k  701554.35k 
>  729893.50k   832176.13k
>
> [...]

> OpenSSL 1.1.1  11 Sep 2018type             16 bytes  64 bytes    256
> bytes   1024 bytes   8192 bytes  16384 bytes
> sha1             90645.60k   245118.29k   455184.27k  684999.34k 
>  752292.25k   822811.06k
>

I have a lot of experience running 'openssl speed' tests and these
numbers would not worry me too much - if you were to run each of these
tests 10 times **on an empty system** , then average the results , then
most likely you will find that the results are within 5% of each other.

IOW, OpenSSL 1.1.1 is just as fast/slow on this purely artificial speed
test as 1.1.0

HTH,

JJK

Reply | Threaded
Open this post in threaded view
|

Re: Reg slowness seen in openssl 1.1.1

Jan Just Keijser-2
In reply to this post by ramakrushna mishra
On 10/05/19 03:16, ramakrushna mishra wrote:

> Hi ,
>
> The results on a AIX machine looks more bad If I am interpreting them
> correctly.
>
> openssl 1.1.0e :
> The 'numbers' are in 1000s of bytes per second processed.
> type             16 bytes     64 bytes    256 bytes  1024 bytes   8192
> bytes  16384 bytes
> sha1             65019.16k   151552.49k   266107.41k  337113.93k 
>  360792.93k   364102.89k
>
>
> openssl 1.1.1 :
> The 'numbers' are in 1000s of bytes per second processed.
> type             16 bytes     64 bytes    256 bytes  1024 bytes   8192
> bytes  16384 bytes
> sha1             10641.28k    21433.09k    38464.85k 48496.92k   
> 49381.38k    51755.48k
>
>
the numbers for openssl 1.1.1 seem wrong - I've ran a similar test on a
POWER8 and POWER9 box and the results for a "out of the box compiled"
openssl 1.1.0 vs openssl 1.1.1 are much closer.
The only difference I did see was the (obsolete) sha1 test on Power8: 
openssl 1.1.1 seems to be a bit slower than 1.1.0, but not by a factor
of 7 as shown above.

Also, on both POWER8 and POWER9, there does not appear to be a major
difference in blowfish or aes-256 speed.

As for your code: I would check that you are not using a no-asm build
for openssl 1.1.1.

HTH,

JJK