Add CryptoMB private key provider to contrib. (#17826)
Intel's IPP (Integrated Performance Primitives) crypto library has support for multi-buffer crypto operations. Briefly, multi-buffer cryptography is implemented with AVX-512 instructions using a SIMD (single instruction, multiple data) mechanism. Up to eight RSA or ECDSA operations are gathered together into a buffer and processed at the same time, providing potentially improved performance. The AVX-512 instructions are available on recently launched 3rd generation Xeon Scalable server processors (Ice Lake server) processors. This commit adds a private key provider to accelerate RSA and ECDSA crypto operations on recent Intel Xeon processors. Every worker thread has a queue of up-to-eight crypto operations. When the queue is full or when the timer is triggered, the queue is processed and all the pending handshakes are notified. The potential performance benefit depends on many factors: the size of the cpuset Envoy is running on, incoming traffic pattern, encryption type (RSA or ECDSA), and key size. In my own testing I saw the biggest performance increase when long RSA keys were used on an Envoy running in a fairly limited environment serving lots of new incoming TLS requests. For more details, see this Intel whitepaper which contains some more information about the AVX-512 instructions and potential performance increase: https://www.intel.com/content/www/us/en/architecture-and-technology/crypto-acceleration-in-xeon-scalable-processors-wp.html Additional Description: One new dependency is introduced: Intel’s ipp-crypto library. Currently the PR is using a development version of ipp-crypto because BoringSSL support is not yet part of any release. The ipp-crypto team has indicated that BoringSSL version will be included in future ipp-crypto releases. Basic tests are provided, and a fake library interface is included for testing on systems without the required AVX-512 instruction set. Risk Level: Medium (TLS security feature, not enabled by default) Testing: Unit tests Docs Changes: API interface is documented Release Notes: Added CryptoMB private key provider to contrib. Platform Specific Features: Requires Intel 3rd generation Xeon Scalable server processor for the AVX-512 IFMA instruction set. Fixes: #15871 Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Co-authored-by: Greg Greenway <ggreenway@apple.com> Mirrored from https://github.com/envoyproxy/envoy @ 2144166ca7a3f100ecae16700bc82920b2de4871pull/624/head
data-plane-api(Azure Pipelines)
3 years ago
parent
4573a23d15
commit
8f26371ee6
4 changed files with 58 additions and 0 deletions
@ -0,0 +1,12 @@ |
||||
# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py. |
||||
|
||||
load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package") |
||||
|
||||
licenses(["notice"]) # Apache 2 |
||||
|
||||
api_proto_package( |
||||
deps = [ |
||||
"//envoy/config/core/v3:pkg", |
||||
"@com_github_cncf_udpa//udpa/annotations:pkg", |
||||
], |
||||
) |
||||
@ -0,0 +1,44 @@ |
||||
syntax = "proto3"; |
||||
|
||||
package envoy.extensions.private_key_providers.cryptomb.v3alpha; |
||||
|
||||
import "envoy/config/core/v3/base.proto"; |
||||
|
||||
import "google/protobuf/duration.proto"; |
||||
|
||||
import "udpa/annotations/sensitive.proto"; |
||||
import "udpa/annotations/status.proto"; |
||||
import "validate/validate.proto"; |
||||
|
||||
option java_package = "io.envoyproxy.envoy.extensions.private_key_providers.cryptomb.v3alpha"; |
||||
option java_outer_classname = "CryptombProto"; |
||||
option java_multiple_files = true; |
||||
option (udpa.annotations.file_status).package_version_status = ACTIVE; |
||||
|
||||
// [#protodoc-title: CryptoMb private key provider] |
||||
// [#extension: envoy.tls.key_providers.cryptomb] |
||||
|
||||
// A CryptoMbPrivateKeyMethodConfig message specifies how the CryptoMb private |
||||
// key provider is configured. The private key provider provides `SIMD` |
||||
// processing for RSA sign and decrypt operations (ECDSA signing uses regular |
||||
// BoringSSL functions). The provider works by gathering the operations into a |
||||
// worker-thread specific queue, and processing the queue using `ipp-crypto` |
||||
// library when the queue is full or when a timer expires. |
||||
// [#extension-category: envoy.tls.key_providers] |
||||
message CryptoMbPrivateKeyMethodConfig { |
||||
// Private key to use in the private key provider. If set to inline_bytes or |
||||
// inline_string, the value needs to be the private key in PEM format. |
||||
config.core.v3.DataSource private_key = 1 [(udpa.annotations.sensitive) = true]; |
||||
|
||||
// How long to wait until the per-thread processing queue should be |
||||
// processed. If the processing queue gets full (eight sign or decrypt |
||||
// requests are received) it is processed immediately. However, if the |
||||
// queue is not filled before the delay has expired, the requests |
||||
// already in the queue are processed, even if the queue is not full. |
||||
// In effect, this value controls the balance between latency and |
||||
// throughput. The duration needs to be set to a non-zero value. |
||||
google.protobuf.Duration poll_delay = 2 [(validate.rules).duration = { |
||||
required: true |
||||
gt {} |
||||
}]; |
||||
} |
||||
Loading…
Reference in new issue