smolcert / smolcert-go

Implementation of CBOR based certificates
MIT License
1 stars 0 forks source link

PR to avoid resource exhaustion by using fxamacker/cbor? #1

Closed x448 closed 4 years ago

x448 commented 4 years ago

Hi @dereulenspiegel smolcert looks like a nice fit for fxamacker/cbor, which supports "toarray", "keyasint", and "omitempty" struct tags while avoiding crashes.

It also has CBOR options which could help identify CBOR settings that could be made explicit in the smolcert specification. For example, whether duplicate map keys are allowed.

Please let me know if you'd be willing to accept a pull request. Thanks.

fxamacker/cbor 2.1 ugorji/go 1.1.7
Bad data 1 57.4 ns/op, 32 B/op, 1 allocs/op ⚠️ fatal error: out of memory
Bad data 2 67.7 ns/op, 32 B/op, 1 allocs/op ⚠️ runtime: out of memory: cannot allocate

Click to expand topic:

API is encoding/json + toarray/keyasint/omitempty struct tags


![image](https://user-images.githubusercontent.com/57072051/74860439-3f9b2080-530e-11ea-9e44-c482f6a6a22e.png)
Compiled Program Size Comparison

fxamacker/cbor produces smaller programs -- both libraries were used for same CBOR activities. And cisco/senml had MessagePack feature removed from all builds. | | fxamacker/cbor 2.1 | ugorji/go 1.1.7 | | --- | --- | --- | | custom app | 2.7 MB | 11.9 MB | | cisco/senml | 7.6 MB | 12 MB |

Speed Comparison

fxamacker/cbor is faster using test data from RFC 8392 A.1 and default options. | | fxamacker/cbor 2.1 | ugorji/go 1.1.7 | | --- | --- | --- | | Encode CWT claims | 457 ns/op | 995 ns/op | | Decode CWT claims | 796 ns/op | 1105 ns/op |

Memory Comparison

fxamacker/cbor uses less memory using test data from RFC 8392 A.1 and default options. | | fxamacker/cbor 2.1 | ugorji/go 1.1.7 | | --- | --- | --- | | Encode CWT claims | 176 B/op, 2 allocs/op | 1424 B/op, 4 allocs/op | | Decode CWT claims | 176 B/op, 6 allocs/op | 568 B/op, 6 allocs/op |

dereulenspiegel commented 4 years ago

Thanks for the hint to your library. It looks really like the better choice. For the next few days I have unfortunately a few other tasks, but once I switch back to this project, I will start porting the code.