engine_pkcs11: performance - offer to sponsorship

Ondřej Surý <[email protected]> Fri, 5 Feb 2021 16:00:15 +0100

Newsgroups	gmane.comp.encryption.opensc.devel
Message-ID	<[email protected]>

Hi OpenSC folks,

Internet Systems Corporation, Inc. maker of BIND 9 is looking for a short-term contractor that would work on engine_pkcs11 performance.

The friendly support staff of Ultra-CIS, the maker of AEP Keeper came up with following observation when comparing engine_pkcs11 to the old Solaris/Oracle OpenSSL patch:

> 	• OpenSC libp11 Engine performs 13 more C_FindObjects calls
> 	• OpenSC libp11 Engine performs 50 more C_GetAttributeValue calls
> 	• OpenSC libp11 Engine performs 1986 more C_SignInit calls
> 	• OpenSC libp11 Engine performs 2174 more C_Sign calls
> 	• OpenSSL patched version uses 17 sessions and OpenSC libp11 Engine only uses 1
> 	• OpenSC libp11 Engine appears not to close it’s session.
> 
> I think the most significant thing here is that OpenSC libp11 Engine only uses one session, whereas OpenSSL patched version uses 17. Using multiple sessions can increase throughput and I suspect this is the reason why OpenSSL patched version has a better performance.

ISC would be willing to sponsor further development of engine_pkcs11 under the same license as the original code and contributed back to OpenSC project. Further details could be discussed with me, but we are generally looking at work that would be of benefit to the BIND 9 users, but also to the whole OpenSC community.

You can contact me on this email or same username at isc.org.

Cheers,
Ondrej
--
Ondřej Surý (He/Him)
[email protected]

_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel

signature.asc (application/pgp-signature, 228 B)