On Sat, Aug 26, 2017 at 11:06:30AM +0200, Niels Möller wrote: > "Daniel P. Berrange" <[email protected]> writes: > > > The nettle-benchmark program currently uses the openssl low level > > cipher APIs for benchmarking. This means it always runs the generic > > software implementation, never able to take advantage of impls > > optimized for new hardware (eg AES-NI). > > > > Rewriting it to use the higher EVP APIs means we can use the same > > code for all ciphers, and automatically trigger hardware optimized > > versions, giving a fairer comparison against openssl as commonly > > used in applications. > > > > Use of the generic openssl impl can still be forced by setting an > > env variable OPENSSL_ia32cap="~0x200000200000000" > > I'm about to apply this. On my machine (with an intel "i3-5010U CPU @ > 2.10GHz"), I get roughly 1.5 GB/s with nettle's aesni, and with your > benchmarking changes, I get twice as much with openssl, 3 GB/s. > Benchmarking the simple but not very useful ecb mode. So there's clearly > some room for further optimization. > > I have a few comments on the code: > > > +struct AESCipher { > > + EVP_CIPHER_CTX *ctx; > > +}; > > This struct seems unused. I'd prefer renaming it to something like > openssl_cipher_ctx, and use it in the rest of the code. > > > +static void > > +openssl_evp_set_encrypt_key(void *ctx, const uint8_t *key, const > > EVP_CIPHER *cipher) > > +{ > > + EVP_CIPHER_CTX **ctxptr = ctx; > > + *ctxptr = EVP_CIPHER_CTX_new(); > > Then this would be rewritten as > > struct openssl_cipher_ctx *openssl = (struct openssl_cipher_ctx *) ctx; > openssl->ctx = EVP_CIPHER_CTX_new(); > > (possibly with some renaming of args, to avoid to many different ctxs. > > And similarly with the other juggling of the EVP_CIPHER_CTX** type.
Yep, that's fine. > > The configure script currently checks for these headers, > > AC_CHECK_HEADERS([openssl/blowfish.h openssl/des.h openssl/cast.h > openssl/aes.h openssl/ecdsa.h] > > I think all the cipher header files should be deleted here, replaced > with a check for openssl/evp.h, do you agree? Yes, I missed that. > Finally, it seems appropriate to add you and/or Redhat to the (c)-header > of examples/nettle-openssl.c, can you send me the correct line? Do you > or Redhat own the copyright for this rewrite? It is under Red Hat copyright, so you can add: Copyright (C) 2017 Red Hat, Inc. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :| _______________________________________________ nettle-bugs mailing list [email protected] http://lists.lysator.liu.se/mailman/listinfo/nettle-bugs
