search

godaddy / asherah

Asherah is a multi-language, cross-platform application encryption SDK
MIT License
75 stars 47 forks source link

[Go] Golang: Degraded, unrecoverable performance of DRR decrypt times after RevokeCheckInterval expires. #385

Closed keperry closed 3 years ago

keperry commented 3 years ago

Describe the bug Golang: Degraded, unrecoverable performance of DRR decrypt times after RevokeCheckInterval expires.

We noticed some large increases in DRR decrypt times - 99 percentile of ael.drr.decrypt (we were using the metrics from the library w/prometheus and grafana). It appeared that the app would never recover. We were trying to upgrade from an older version (not in this repo) to the latest version v0.2.1 See screenshot below: DataFabric_-_Encryption_Database_Metrics_-_Grafana_and_mgntapi_–_encryption_go

To Reproduce Steps to reproduce the behavior:

  1. Use default crypto policy (RevokeCheckInterval at 60m). You can reduce this to reduce test timing.
  2. Startup app using this that uses decrypt
  3. At the RefreshCheckInterval, you will see DRR times skyrocket (10x?). They seem to keep climbing until the app is unusable.

Note: In PR, I will have a test and benchmark test to reproduce.

Expected behavior We expect that after the RevokeCheckInterval expires that there is a slight hit in performance when the new system/intermediate keys are loaded, but the app should be usable after this point.

Screenshots See above.

PR coming soon.

tarkatronic commented 3 years ago

Fixed in #386