summaryrefslogtreecommitdiffstats
path: root/test/CAtsa.cnf (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-11-12Optimize AES-XTS mode in OpenSSL for aarch64XiaokangQian3-0/+1468
Aes-xts mode can be optimized by interleaving cipher operation on several blocks and loop unrolling. Interleaving needs one ideal unrolling factor, here we adopt the same factor with aes-cbc, which is described as below: If blocks number > 5, select 5 blocks as one iteration,every loop, decrease the blocks number by 5. If left blocks < 5, treat them as tail blocks. Detailed implementation has a little adjustment for squeezing code space. With this way, for small size such as 16 bytes, the performance is similar as before, but for big size such as 16k bytes, the performance improves a lot, even reaches to 2x uplift, for some arches such as A57, the improvement even reaches more than 2x uplift. We collect many performance datas on different micro-archs such as thunderx2, ampere-emag, a72, a75, a57, a53 and N1, all of which reach 0.5-2x uplift. The following table lists the encryption performance data on aarch64, take a72, a75, a57, a53 and N1 as examples. Performance value takes the unit of cycles per byte, takes the format as comparision of values. List them as below: A72: Before optimization After optimization Improve evp-aes-128-xts@16 8.899913518 5.949087263 49.60% evp-aes-128-xts@64 4.525512668 3.389141845 33.53% evp-aes-128-xts@256 3.502906908 1.633573479 114.43% evp-aes-128-xts@1024 3.174210419 1.155952639 174.60% evp-aes-128-xts@8192 3.053019303 1.028134888 196.95% evp-aes-128-xts@16384 3.025292462 1.02021169 196.54% evp-aes-256-xts@16 9.971105023 6.754233758 47.63% evp-aes-256-xts@64 4.931479093 3.786527393 30.24% evp-aes-256-xts@256 3.746788153 1.943975947 92.74% evp-aes-256-xts@1024 3.401743802 1.477394648 130.25% evp-aes-256-xts@8192 3.278769327 1.32950421 146.62% evp-aes-256-xts@16384 3.27093296 1.325276257 146.81% A75: Before optimization After optimization Improve evp-aes-128-xts@16 8.397965173 5.126839098 63.80% evp-aes-128-xts@64 4.176860631 2.59817764 60.76% evp-aes-128-xts@256 3.069126585 1.284561028 138.92% evp-aes-128-xts@1024 2.805962699 0.932754655 200.83% evp-aes-128-xts@8192 2.725820131 0.829820397 228.48% evp-aes-128-xts@16384 2.71521905 0.823251591 229.82% evp-aes-256-xts@16 11.24790935 7.383914448 52.33% evp-aes-256-xts@64 5.294128847 3.048641998 73.66% evp-aes-256-xts@256 3.861649617 1.570359905 145.91% evp-aes-256-xts@1024 3.537646797 1.200493533 194.68% evp-aes-256-xts@8192 3.435353012 1.085345319 216.52% evp-aes-256-xts@16384 3.437952563 1.097963822 213.12% A57: Before optimization After optimization Improve evp-aes-128-xts@16 10.57455446 7.165438012 47.58% evp-aes-128-xts@64 5.418185447 3.721241202 45.60% evp-aes-128-xts@256 3.855184592 1.747145379 120.66% evp-aes-128-xts@1024 3.477199757 1.253049735 177.50% evp-aes-128-xts@8192 3.36768104 1.091943159 208.41% evp-aes-128-xts@16384 3.360373443 1.088942789 208.59% evp-aes-256-xts@16 12.54559459 8.745489036 43.45% evp-aes-256-xts@64 6.542808937 4.326387568 51.23% evp-aes-256-xts@256 4.62668822 2.119908754 118.25% evp-aes-256-xts@1024 4.161716505 1.557335554 167.23% evp-aes-256-xts@8192 4.032462227 1.377749511 192.68% evp-aes-256-xts@16384 4.023293877 1.371558933 193.34% A53: Before optimization After optimization Improve evp-aes-128-xts@16 18.07842135 13.96980808 29.40% evp-aes-128-xts@64 7.933818397 6.07159276 30.70% evp-aes-128-xts@256 5.264604704 2.611155744 101.60% evp-aes-128-xts@1024 4.606660117 1.722713454 167.40% evp-aes-128-xts@8192 4.405160115 1.454379201 202.90% evp-aes-128-xts@16384 4.401592028 1.442279392 205.20% evp-aes-256-xts@16 20.07084054 16.00803726 25.40% evp-aes-256-xts@64 9.192647294 6.883876732 33.50% evp-aes-256-xts@256 6.336143161 3.108140452 103.90% evp-aes-256-xts@1024 5.62502952 2.097960651 168.10% evp-aes-256-xts@8192 5.412085608 1.807294191 199.50% evp-aes-256-xts@16384 5.403062591 1.790135764 201.80% N1: Before optimization After optimization Improve evp-aes-128-xts@16 6.48147613 4.209415473 53.98% evp-aes-128-xts@64 2.847744115 1.950757468 45.98% evp-aes-128-xts@256 2.085711968 1.061903238 96.41% evp-aes-128-xts@1024 1.842014669 0.798486302 130.69% evp-aes-128-xts@8192 1.760449052 0.713853939 146.61% evp-aes-128-xts@16384 1.760763546 0.707702009 148.80% evp-aes-256-xts@16 7.264142817 5.265970454 37.94% evp-aes-256-xts@64 3.251356212 2.41176323 34.81% evp-aes-256-xts@256 2.380488469 1.342095742 77.37% evp-aes-256-xts@1024 2.08853022 1.041718215 100.49% evp-aes-256-xts@8192 2.027432668 0.944571334 114.64% evp-aes-256-xts@16384 2.00740782 0.941991415 113.10% Add more XTS test cases to cover the cipher stealing mode and cases of different number of blocks. CustomizedGitHooks: yes Change-Id: I93ee31b2575e1413764e27b599af62994deb4c96 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11399)
2020-11-11apps/passwd: remove the -crypt option.Pauli4-52/+14
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13313)
2020-11-11rsa_test: add return value checkPauli1-11/+13
Fixes #13361 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13362)
2020-11-11Do not prepend $OPENSSL_CONF_INCLUDE to absolute include pathsTomas Mraz1-2/+9
Also check for malloc failure and do not add '/' when $OPENSSL_CONF_INCLUDE already ends with directory separator. Fixes #13302 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13306)
2020-11-11Add ossl_is_absolute_path function to detect absolute pathsTomas Mraz2-4/+27
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13306)
2020-11-11Avoid duplicate ends_with_dirsep functionsTomas Mraz4-30/+55
Refactor them into inline ossl_ends_with_dirsep function in internal/cryptlib.h. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13306)
2020-11-11test/recipes/30-test_evp_libctx.t: use fips-and-base.cnfRichard Levitte1-1/+1
The FIPS provider module doesn't have any encoders, the base provider is needed for that. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11test/evp_libctx_test.c: use OSSL_ENCODER instead of i2d_PublicKey()Richard Levitte1-2/+11
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11test/endecode_test.c: Update to specify output structuresRichard Levitte2-85/+75
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11Adapt libcrypto functionality to specify the desired output structureRichard Levitte9-133/+142
This also modifies i2d_PublicKey() and i2d_KeyParams() to support provided keys. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11PROV: Re-implement all the keypair encodersRichard Levitte5-223/+842
The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11ENCODER: Add tracingRichard Levitte4-7/+86
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11ENCODER: Add output structure support for EVP_PKEY encodingRichard Levitte4-209/+287
OSSL_ENCODER_CTX_new_by_EVP_PKEY() takes one more argument to express the desired outermost structure for the output. This also adds OSSL_ENCODER_CTX_prune_encoders(), which is used to reduce the stack of encoders found according to criteria formed from the combination of desired selection, output type and output structure. squash! ENCODER: Add output structure support for EVP_PKEY encoding Replace the paragraph talking about OSSL_ENCODER_CTX_prune_encoders() with: The encoding processor encoder_process() is enhanced with better analysis of the stack of encoder implementations. To avoid having to keep an on the side array of information, it uses recursion. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11ENCODER: Add support for OSSL_FUNC_encoder_does_selection()Richard Levitte4-8/+22
OSSL_FUNC_encoder_does_selection() is a dispatchable encoder implementation function that should return 1 if the given |selection| is supported by an encoder implementation and 0 if not. This can be used by libcrypto functionality to figure out if an encoder implementation should be considered or not. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11ENCODER: Add support for specifying the outermost output structureRichard Levitte7-48/+135
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11CORE: Add support for specifying the outermost object structureRichard Levitte2-5/+11
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-11-11Convert all {NAME}err() in providers/ to their corresponding ERR_raise() callRichard Levitte8-64/+64
This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13319)
2020-11-11SSL: refactor all SSLfatal() callsRichard Levitte27-2181/+1055
Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-11SSL: refactor ossl_statem_fatal() and SSLfatal()Richard Levitte2-13/+16
ossl_statem_fatal() is refactored to be an extended ERR_set_error(), and SSLfatal() is refactored to work like ERR_raise(). We also add SSLfatal_data() to work like ERR_raise_data(). Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-11Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() callRichard Levitte27-370/+340
This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-11OSSL_STORE: Make sure the called OSSL_DECODER knows what to expectRichard Levitte1-7/+32
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-11PEM: Have pem_read_bio_key() set the OSSL_STORE expected typeRichard Levitte1-0/+3
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-11Restore the legacy implementation of PEM_read_bio_DHparams()Richard Levitte2-61/+44
It was an overstep to have it got through OSSL_STORE just to extract a DH pointer from the resulting EVP_PKEY. This partially reverts 1427d33cee59d6fe54efe1b5a322a1d7c8c03c20 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-11TEST: Adapt test/endecoder_test.cRichard Levitte1-0/+2
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-11DH: Move the code to set the DH sub-typeRichard Levitte2-5/+7
It's been moved so the type is set by d2i_DHparams() and d2i_DHxparams() Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-11Adapt libcrypto functionality to specify the desired input structureRichard Levitte2-13/+7
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-11PROV: Re-implement all the keypair decodersRichard Levitte8-125/+582
The base functionality to implement the keypair decoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be expected as input, the input type ("DER", "PEM", ...) and the outermost input structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-11DECODER: Add tracingRichard Levitte4-3/+41
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-11DECODER: Add input structure support for EVP_PKEY decodingRichard Levitte3-10/+86
OSSL_DECODER_CTX_new_by_EVP_PKEY() takes one more argument to express the desired outermost structure for the input. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-11DECODER: Add support for OSSL_FUNC_decoder_does_selection()Richard Levitte3-3/+12
OSSL_FUNC_decoder_does_selection() is a dispatchable decoder implementation function that should return 1 if the given |selection| is supported by an decoder implementation and 0 if not. This can be used by libcrypto functionality to figure out if an encoder implementation should be considered or not. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-11DECODER: Add support for specifying the outermost input structureRichard Levitte5-7/+87
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13248)
2020-11-1125-test_x509.t: Re-add and improve a test on non-existence of ASN.1 parse errorsDr. David von Oheimb1-2/+6
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13353)
2020-11-11cmp_msg.c: Use issuer of reference cert as default issuer entry in certTemplateDr. David von Oheimb3-6/+12
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13357)
2020-11-11Add support for making all of KBKDF FixedInput fields optional.Shane Lontis4-16/+134
Added settable integer parameters OSSL_KDF_PARAM_KBKDF_USE_L, OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR. This is required for CAVS tests that only use a combined blob of inputdata. A test showing this use case has been added. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13258)
2020-11-10Remove some redundant error messages in the appsMatt Caswell1-8/+1
We change the load_key() and load_pubkey() functions to make them more consistent with the load_keyparams() function modified as a result of PR #13317. The error message on a NULL key is removed, because an error message has already been displayed by load_key_certs_crls(). Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13355)
2020-11-10Fix the reading of DSA parameters files using the dsaparam appMatt Caswell3-12/+15
DSA parameters files were failing to load correctly. We also fix a number of follow on issues which resulted in multiple similar errors messages being displayed for the same problem, as well as a seg-fault. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13317)
2020-11-10Document pkcs12 alg NONEPali Rohár1-0/+2
To generate unencrypted PKCS#12 file it is needed to use options: -keypbe NONE -certpbe NONE CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12426)
2020-11-10openssl-cmp.pod.in: Clean up doc of -verify_email, -verify_hostname, and ↵Dr. David von Oheimb1-65/+28
-verify_ip Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12932)
2020-11-10openssl.pod: Improve doc of -verify_email, -verify_hostname, and -verify_ipDr. David von Oheimb1-6/+6
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12932)
2020-11-10openssl-*.pod.in: Prevent newlines on empty engine_synopsis causing layout ↵Dr. David von Oheimb33-67/+35
errors Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12932)
2020-11-10openssl-cmp.pod.in: Align order of options with apps/cmp.c; improve ↵Dr. David von Oheimb1-115/+119
structuring of SYNOPSIS Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12932)
2020-11-10apps/cmp.c: Improve order of -path option: just after -serverDr. David von Oheimb1-5/+6
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12932)
2020-11-10PEM: Always use PEM_def_callback() when cb == NULL in pem_read_bio_key()Richard Levitte1-5/+2
Too many other functions depend on this being done. Fixes #13340 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13346)
2020-11-10UI: Use OPENSSL_zalloc() in general_allocate_prompt()Richard Levitte1-1/+1
This is to ensure that fields we don't set explicitly are always zero. Fixes #13340 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13346)
2020-11-10Fix REF_PRINT_COUNT argument in ecx_key_freeDaniel Bevenius1-1/+1
Currently, when configuring OpenSSL using -DREF_PRINT the following compilation error is generated: In file included from include/crypto/ecx.h:21, from crypto/ec/ecx_key.c:11: crypto/ec/ecx_key.c: In function 'ecx_key_free': crypto/ec/ecx_key.c:65:32: error: 'r' undeclared (first use in this function) 65 | REF_PRINT_COUNT("ECX_KEY", r); | ^ include/internal/refcount.h:169:40: note: in definition of macro 'REF_PRINT_COUNT' 169 | fprintf(stderr, "%p:%4d:%s\n", b, b->references, a) | ^ crypto/ec/ecx_key.c:65:32: note: each undeclared identifier is reported only once for each function it appears in 65 | REF_PRINT_COUNT("ECX_KEY", r); | ^ include/internal/refcount.h:169:40: note: in definition of macro 'REF_PRINT_COUNT' 169 | fprintf(stderr, "%p:%4d:%s\n", b, b->references, a) | ^ make[1]: *** [Makefile:14929: crypto/ec/libcrypto-lib-ecx_key.o] Error 1 This commit updates the argument passed in to be the ECX_KEY* key. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13298)
2020-11-08Remove test that breaks on AIX.Shane Lontis1-3/+1
The offending test checks that fopen("anydir/") fails. This looks fairly platform specific. For the test involved this creates a file called "anydir" on an AIX test machine. This change was introduced on (Sept 24) https://github.com/openssl/openssl/commit/29844ea5b3d2b7240d99b043a0d82cb177f0762d Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13309)
2020-11-08This should fix a lock-order-inversionBernd Edlinger1-2/+3
Calling OPENSSL_init_crypto before acquiring the ossl_property_read_lock in ossl_method_store_fetch makes the second call to OPENSSL_init_crypto from ossl_ctx_global_properties unnecessary. Fixes #12869 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/13321)
2020-11-07test/evp_extra_test.c: Modify to reflect provider support in test_EVP_PKEY_checkRichard Levitte1-2/+2
With our providers, RSA now supports public key check and key parameter check. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13334)
2020-11-07EVP: Have all EVP_PKEY check functions export to provider if possibleRichard Levitte1-36/+41
Fixes #13322 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13334)
2020-11-07Fix test/recipes/80-test_ca.t to skip_all properly in a subtestRichard Levitte1-9/+11
It's perfectlt ok to 'plan skip_all' in a subtest, but in that case, it must really be inside the subtest. Fixes #13330 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13331)
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-10 07:37:13 +0100