openssl / project

Tracking of project related issues
1 stars 0 forks source link

Implement an abbreviated peer key validation in evp_pkey_derive_set_peer #648

Open nhorman opened 3 weeks ago

nhorman commented 3 weeks ago

Based on the commentary in https://github.com/openssl/openssl/issues/21833 , it seems likely that the performance regression is due to an expensive validation operation which didn't exist in 1.1.1 (but needs to). suggested performance improvement is to use an abbreviated check on prime curves, which are guaranteed to have properties needed to allow said abbreviated checks (see comment here

### Tasks
- [ ] Modify EVP_PKEY_derive_set_peer[_ex] to do a quick check on prime curves, otherwise preform a full check
- [ ] rerun perf tests from prior issues in the tracking epic to confirm performance improvement