CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/11/06 07:09:18
Modified files:
lib/libcrypto/ec: ec_curve.c ec_lib.c ec_local.h ecp_methods.c
regress/lib/libcrypto/ec: Makefile
Added files:
lib/libcrypto/ec: ec_curve_tables.h
regress/lib/libcrypto/ec: ec_builtin_test.c
Log message:
Make the built-in EC groups copies of static templates
So while beating on the cost of decoding X509 certificates and
attempting to find out where things were expensive. P256 lept out
and bit me. It was appallingly slower to deal with a P256 public
key than other things. and it was dominating the cost of an X509
parse, due to it rolling the group from scratch, every time.
Building a built-in group at runtime was most of the cost of decoding
an EC key, which hits every EC key in libcrypto and libssl, including
certificate keys and ECDHE.
So of course I looked at Boring, which made everything static.
EC_GROUP_new_by_curve_name() now copies a static EC_GROUP whose curve
parameters, Montgomery context and generator are precomputed constants
shared by every copy. The constants have 64-bit and 32-bit word
versions. EC_GROUP_free() leaves the shared data alone, EC_GROUP_dup()
of a built-in group copies only the group itself, and
EC_GROUP_set_curve() and EC_GROUP_set_generator() fail on a built-in
group. The asn1 flag, point conversion form, curve name and seed
setters still work, and a seed set on a built-in group is owned by that
group. The values were generated by a "throwaway" program that pulled
the values out of ec_curves.c, but I kept it in regress so it could
notice if anything changed.
Unlike BoringSSL, where every caller shares a single static EC_GROUP
and those setters do nothing, each caller gets its own copy of the
group, so explicit parameter and compressed point encoding keep
working. The copy is what remains of the cost of a new group, about
0.2us, so it cost almost nothing to keep these working.
Times in microseconds on an aarch64 VM:
before after
EC_GROUP_new_by_curve_name + free
P-256 22.5 0.24
P-384 25.0 0.23
P-521 25.3 0.23
d2i_PUBKEY
P-256 29.7 12.8
P-384 34.4 14.6
P-521 35.0 15.2
RSA-2048 7.3 7.2
Ed25519 2.3 2.3
ok tb@
