** Description changed: Original report ================================================================================ Problem Description Ubuntu 24.04’s OpenSSL packaging currently enables the enable- ec_nistp_64_gcc_128 configure option only on amd64: ifeq ($(DEB_HOST_ARCH_CPU), amd64) CONFARGS += enable-ec_nistp_64_gcc_128 endif However, Debian’s OpenSSL packaging (which should serve as the reference) enables this optimization on multiple 64-bit architectures: ifneq ($(filter amd64 arm64 ppc64el riscv64,$(DEB_HOST_ARCH_CPU)),) CONFARGS += enable-ec_nistp_64_gcc_128 endif Security Impact This packaging discrepancy is not just a performance issue but has security implications: D(HE)at-like Attack Vector: Slow elliptic curve operations significantly increase the computational cost of ECDHE and ECDSA operations during TLS handshakes. Servers running Ubuntu 24.04 on aarch64, ppc64el, or riscv64 are more vulnerable to resource exhaustion attacks that exploit slow handshake processing. Asymmetric Defense: The optimization is only enabled on x86_64, creating an attack surface inequality across different architectures. This means the same server hardware type running x86_64 vs aarch64 would have different resistance to ECDHE-based DoS attacks. TLS Performance: The P-256 curve is widely used in TLS, and without this optimization, handshake processing is substantially slower, making servers more susceptible to overwhelming during traffic bursts. ================================================================================ [ Impact ] * Fix performance issue on all 64-bit little-endian architectures. * The upload enables enable-ec_nistp_64_gcc_128 (support for optimised implementations of some commonly used NIST elliptic curves) on arm64, ppc64el, and riscv64. [ Test Plan ] # install openssl and libssl-dev ubuntu@ravi-sharma-sru2130576:~$ apt policy openssl libssl-dev openssl: - Installed: 3.0.13-0ubuntu3.12 - Candidate: 3.0.13-0ubuntu3.12 - Version table: - *** 3.0.13-0ubuntu3.12 500 - 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 Packages - 100 /var/lib/dpkg/status - 3.0.13-0ubuntu3 500 - 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble/main arm64 Packages + Installed: 3.0.13-0ubuntu3.12 + Candidate: 3.0.13-0ubuntu3.12 + Version table: + *** 3.0.13-0ubuntu3.12 500 + 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 Packages + 100 /var/lib/dpkg/status + 3.0.13-0ubuntu3 500 + 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble/main arm64 Packages libssl-dev: - Installed: 3.0.13-0ubuntu3.12 - Candidate: 3.0.13-0ubuntu3.12 - Version table: - *** 3.0.13-0ubuntu3.12 500 - 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 Packages - 100 /var/lib/dpkg/status - 3.0.13-0ubuntu3 500 - 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble/main arm64 Packages + Installed: 3.0.13-0ubuntu3.12 + Candidate: 3.0.13-0ubuntu3.12 + Version table: + *** 3.0.13-0ubuntu3.12 500 + 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 Packages + 100 /var/lib/dpkg/status + 3.0.13-0ubuntu3 500 + 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble/main arm64 Packages # verify symbols are missing ubuntu@ravi-sharma-sru2130576:~$ nm /usr/lib/aarch64-linux-gnu/libcrypto.a | grep EC_GFp_nistp224_method ubuntu@ravi-sharma-sru2130576:~$ # run benchmarks baseline (do this a couple of times and save the recordings in a file) ubuntu@ravi-sharma-sru2130576:~$ taskset -c 0 openssl speed -elapsed -seconds 10 ecdsap224 ecdhp224 ecdsap521 ecdhp521 You have chosen to measure elapsed time instead of user CPU time. Doing 224 bits sign ecdsa's for 10s: 16681 224 bits ECDSA signs in 10.00s Doing 224 bits verify ecdsa's for 10s: 19448 224 bits ECDSA verify in 10.00s Doing 521 bits sign ecdsa's for 10s: 1912 521 bits ECDSA signs in 10.00s Doing 521 bits verify ecdsa's for 10s: 2568 521 bits ECDSA verify in 10.00s Doing 224 bits ecdh's for 10s: 17825 224-bits ECDH ops in 10.00s Doing 521 bits ecdh's for 10s: 2037 521-bits ECDH ops in 10.00s version: 3.0.13 built on: Wed Jul 29 16:55:30 2026 UTC options: bn(64,64) compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -fzero-call-used-regs=used-gpr -DOPENSSL_TLS_SECURITY_LEVEL=2 -Wa,--noexecstack -g -O2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -ffile-prefix-map=/build/openssl-s2Z99D/openssl-3.0.13=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -fdebug-prefix-map=/build/openssl-s2Z99D/openssl-3.0.13=/usr/src/openssl-3.0.13-0ubuntu3.12 -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=3 CPUINFO: OPENSSL_armcap=0xbd - sign verify sign/s verify/s - 224 bits ecdsa (nistp224) 0.0006s 0.0005s 1668.1 1944.8 - 521 bits ecdsa (nistp521) 0.0052s 0.0039s 191.2 256.8 - op op/s - 224 bits ecdh (nistp224) 0.0006s 1782.5 - 521 bits ecdh (nistp521) 0.0049s 203.7 + sign verify sign/s verify/s + 224 bits ecdsa (nistp224) 0.0006s 0.0005s 1668.1 1944.8 + 521 bits ecdsa (nistp521) 0.0052s 0.0039s 191.2 256.8 + op op/s + 224 bits ecdh (nistp224) 0.0006s 1782.5 + 521 bits ecdh (nistp521) 0.0049s 203.7 ubuntu@ravi-sharma-sru2130576:~$ taskset -c 0 openssl speed -elapsed -seconds 10 ecdsap224 ecdhp224 ecdsap521 ecdhp521 You have chosen to measure elapsed time instead of user CPU time. Doing 224 bits sign ecdsa's for 10s: 16783 224 bits ECDSA signs in 10.00s Doing 224 bits verify ecdsa's for 10s: 19432 224 bits ECDSA verify in 10.00s Doing 521 bits sign ecdsa's for 10s: 1912 521 bits ECDSA signs in 10.00s Doing 521 bits verify ecdsa's for 10s: 2568 521 bits ECDSA verify in 10.01s Doing 224 bits ecdh's for 10s: 17851 224-bits ECDH ops in 10.00s Doing 521 bits ecdh's for 10s: 2039 521-bits ECDH ops in 10.00s version: 3.0.13 built on: Wed Jul 29 16:55:30 2026 UTC options: bn(64,64) compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -fzero-call-used-regs=used-gpr -DOPENSSL_TLS_SECURITY_LEVEL=2 -Wa,--noexecstack -g -O2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -ffile-prefix-map=/build/openssl-s2Z99D/openssl-3.0.13=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -fdebug-prefix-map=/build/openssl-s2Z99D/openssl-3.0.13=/usr/src/openssl-3.0.13-0ubuntu3.12 -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=3 CPUINFO: OPENSSL_armcap=0xbd - sign verify sign/s verify/s - 224 bits ecdsa (nistp224) 0.0006s 0.0005s 1678.3 1943.2 - 521 bits ecdsa (nistp521) 0.0052s 0.0039s 191.2 256.5 - op op/s - 224 bits ecdh (nistp224) 0.0006s 1785.1 - 521 bits ecdh (nistp521) 0.0049s 203.9 + sign verify sign/s verify/s + 224 bits ecdsa (nistp224) 0.0006s 0.0005s 1678.3 1943.2 + 521 bits ecdsa (nistp521) 0.0052s 0.0039s 191.2 256.5 + op op/s + 224 bits ecdh (nistp224) 0.0006s 1785.1 + 521 bits ecdh (nistp521) 0.0049s 203.9 - # Add ppa - ubuntu@ravi-sharma-2130576:~$ sudo add-apt-repository ppa:ravi-sharma/noble-sru-2026-04 - # install(sudo apt install openssl libssl-dev) and check new versions + # install packages from proposed (sudo apt install openssl libssl-dev) and check new versions. Example below is from a ppa, but the test MUST be conducted with packages from proposed: + ubuntu@ravi-sharma-sru2130576:~$ apt policy openssl libssl-dev openssl: - Installed: 3.0.13-0ubuntu3.13~ppa1 - Candidate: 3.0.13-0ubuntu3.13~ppa1 - Version table: - *** 3.0.13-0ubuntu3.13~ppa1 500 - 500 https://ppa.launchpadcontent.net/ravi-sharma/noble-sru-2026-04/ubuntu noble/main arm64 Packages - 100 /var/lib/dpkg/status - 3.0.13-0ubuntu3.12 500 - 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 Packages - 500 http://ports.ubuntu.com/ubuntu-ports noble-security/main arm64 Packages - 3.0.13-0ubuntu3 500 - 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble/main arm64 Packages + Installed: 3.0.13-0ubuntu3.13~ppa1 + Candidate: 3.0.13-0ubuntu3.13~ppa1 + Version table: + *** 3.0.13-0ubuntu3.13~ppa1 500 + 500 https://ppa.launchpadcontent.net/ravi-sharma/noble-sru-2026-04/ubuntu noble/main arm64 Packages + 100 /var/lib/dpkg/status + 3.0.13-0ubuntu3.12 500 + 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 Packages + 500 http://ports.ubuntu.com/ubuntu-ports noble-security/main arm64 Packages + 3.0.13-0ubuntu3 500 + 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble/main arm64 Packages libssl-dev: - Installed: 3.0.13-0ubuntu3.13~ppa1 - Candidate: 3.0.13-0ubuntu3.13~ppa1 - Version table: - *** 3.0.13-0ubuntu3.13~ppa1 500 - 500 https://ppa.launchpadcontent.net/ravi-sharma/noble-sru-2026-04/ubuntu noble/main arm64 Packages - 100 /var/lib/dpkg/status - 3.0.13-0ubuntu3.12 500 - 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 Packages - 500 http://ports.ubuntu.com/ubuntu-ports noble-security/main arm64 Packages - 3.0.13-0ubuntu3 500 - 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble/main arm64 Packages + Installed: 3.0.13-0ubuntu3.13~ppa1 + Candidate: 3.0.13-0ubuntu3.13~ppa1 + Version table: + *** 3.0.13-0ubuntu3.13~ppa1 500 + 500 https://ppa.launchpadcontent.net/ravi-sharma/noble-sru-2026-04/ubuntu noble/main arm64 Packages + 100 /var/lib/dpkg/status + 3.0.13-0ubuntu3.12 500 + 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 Packages + 500 http://ports.ubuntu.com/ubuntu-ports noble-security/main arm64 Packages + 3.0.13-0ubuntu3 500 + 500 http://availability-zone-1.clouds.ports.ubuntu.com/ubuntu-ports noble/main arm64 Packages # symbols should be present now ubuntu@ravi-sharma-sru2130576:~$ nm /usr/lib/aarch64-linux-gnu/libcrypto.a | grep EC_GFp_nistp224_method - U EC_GFp_nistp224_method + U EC_GFp_nistp224_method 0000000000002f04 T EC_GFp_nistp224_method # run benchmarks again (look at the difference in sign/s, verify/s, and op/s) ubuntu@ravi-sharma-sru2130576:~$ taskset -c 0 openssl speed -elapsed -seconds 10 ecdsap224 ecdhp224 ecdsap521 ecdhp521 You have chosen to measure elapsed time instead of user CPU time. Doing 224 bits sign ecdsa's for 10s: 106937 224 bits ECDSA signs in 10.00s Doing 224 bits verify ecdsa's for 10s: 48253 224 bits ECDSA verify in 10.00s Doing 521 bits sign ecdsa's for 10s: 11307 521 bits ECDSA signs in 10.00s Doing 521 bits verify ecdsa's for 10s: 5695 521 bits ECDSA verify in 10.00s Doing 224 bits ecdh's for 10s: 72786 224-bits ECDH ops in 10.00s Doing 521 bits ecdh's for 10s: 9000 521-bits ECDH ops in 10.00s version: 3.0.13 built on: Wed Aug 5 10:19:06 2026 UTC options: bn(64,64) compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -fzero-call-used-regs=used-gpr -DOPENSSL_TLS_SECURITY_LEVEL=2 -Wa,--noexecstack -g -O2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -ffile-prefix-map=/build/openssl-lxsv0k/openssl-3.0.13=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -fdebug-prefix-map=/build/openssl-lxsv0k/openssl-3.0.13=/usr/src/openssl-3.0.13-0ubuntu3.13~ppa1 -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=3 CPUINFO: OPENSSL_armcap=0xbd - sign verify sign/s verify/s - 224 bits ecdsa (nistp224) 0.0001s 0.0002s 10693.7 4825.3 - 521 bits ecdsa (nistp521) 0.0009s 0.0018s 1130.7 569.5 - op op/s - 224 bits ecdh (nistp224) 0.0001s 7278.6 - 521 bits ecdh (nistp521) 0.0011s 900.0 + sign verify sign/s verify/s + 224 bits ecdsa (nistp224) 0.0001s 0.0002s 10693.7 4825.3 + 521 bits ecdsa (nistp521) 0.0009s 0.0018s 1130.7 569.5 + op op/s + 224 bits ecdh (nistp224) 0.0001s 7278.6 + 521 bits ecdh (nistp521) 0.0011s 900.0 ubuntu@ravi-sharma-sru2130576:~$ taskset -c 0 openssl speed -elapsed -seconds 10 ecdsap224 ecdhp224 ecdsap521 ecdhp521 You have chosen to measure elapsed time instead of user CPU time. Doing 224 bits sign ecdsa's for 10s: 106693 224 bits ECDSA signs in 10.00s Doing 224 bits verify ecdsa's for 10s: 48214 224 bits ECDSA verify in 10.00s Doing 521 bits sign ecdsa's for 10s: 11316 521 bits ECDSA signs in 10.01s Doing 521 bits verify ecdsa's for 10s: 5685 521 bits ECDSA verify in 10.00s Doing 224 bits ecdh's for 10s: 72963 224-bits ECDH ops in 10.00s Doing 521 bits ecdh's for 10s: 8982 521-bits ECDH ops in 10.00s version: 3.0.13 built on: Wed Aug 5 10:19:06 2026 UTC options: bn(64,64) compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -fzero-call-used-regs=used-gpr -DOPENSSL_TLS_SECURITY_LEVEL=2 -Wa,--noexecstack -g -O2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -ffile-prefix-map=/build/openssl-lxsv0k/openssl-3.0.13=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -fdebug-prefix-map=/build/openssl-lxsv0k/openssl-3.0.13=/usr/src/openssl-3.0.13-0ubuntu3.13~ppa1 -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=3 CPUINFO: OPENSSL_armcap=0xbd - sign verify sign/s verify/s - 224 bits ecdsa (nistp224) 0.0001s 0.0002s 10669.3 4821.4 - 521 bits ecdsa (nistp521) 0.0009s 0.0018s 1130.5 568.5 - op op/s - 224 bits ecdh (nistp224) 0.0001s 7296.3 - 521 bits ecdh (nistp521) 0.0011s 898.2 + sign verify sign/s verify/s + 224 bits ecdsa (nistp224) 0.0001s 0.0002s 10669.3 4821.4 + 521 bits ecdsa (nistp521) 0.0009s 0.0018s 1130.5 568.5 + op op/s + 224 bits ecdh (nistp224) 0.0001s 7296.3 + 521 bits ecdh (nistp521) 0.0011s 898.2 ubuntu@ravi-sharma-sru2130576:~$ [ Where problems could occur ] * I can't think of a scenario where enabling this optimization will lead to a problem. [ Other Info ] * I am also adding a low prio fix as part of this SRU. https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2107167
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2130576 Title: Missing ec_nistp_64_gcc_128 optimization on non-x86_64 architectures To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2130576/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
