Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PKCS11 multi-threading #264

Closed
ionut-arm opened this issue Oct 13, 2020 · 0 comments · Fixed by #277
Closed

PKCS11 multi-threading #264

ionut-arm opened this issue Oct 13, 2020 · 0 comments · Fixed by #277
Assignees
@ionut-arm
Labels
bug Something isn't working

Comments

@ionut-arm
Copy link
Member

Currently our PKCS11 provider is forcibly kept single-threaded - all crypto or key management operations have to take a lock that ensures only one is executing at any time. This is because of an issue probably found in SoftHSM2. We raised a point with them about it and got a partial fix, but even with that fix there are still failures.
The problem is that when run in a multi-threaded way, without locking, generate and import key operations start failing (with CKR_GENERAL_ERROR or CKR_TEMPLATE_INCONSISTENT). Given that this happens pretty consistently, the CI would've failed so we made the decision to simply lock down the provider. This comes at the cost of performance of said provider, but we're not that worried about that for now.

On the SoftHSM side softhsm/SoftHSMv2#576 was raised to fix this and I've tested with the initial commits. The issue was still happening, but much less frequently. I've yet to test with the latest commit as well - hopefully that fixes the issue and we can then remove the locking.
@ionut-arm ionut-arm added the bug Something isn't working label Oct 13, 2020
@ionut-arm ionut-arm self-assigned this Oct 13, 2020
ionut-arm added a commit to ionut-arm/parsec that referenced this issue Oct 22, 2020
@ionut-arm
Remove PKCS11 single thread lock (parallaxsecond#264)
a41e201 
This commit removes the mutex that was used to force the PKCS11 provider
to work in a single-threaded way. The issue was fixed in
softhsm/SoftHSMv2#576 and our Dockerfiles
have been updated to use that commit.

Signed-off-by: Ionut Mihalcea <ionut.mihalcea@arm.com>
ionut-arm added a commit to ionut-arm/parsec that referenced this issue Oct 22, 2020
@ionut-arm
Remove PKCS11 single thread lock (parallaxsecond#264)
7d3f848 
This commit removes the mutex that was used to force the PKCS11 provider
to work in a single-threaded way. The issue was fixed in
softhsm/SoftHSMv2#576 and our Dockerfiles
have been updated to use that commit.

Signed-off-by: Ionut Mihalcea <ionut.mihalcea@arm.com>
@ionut-arm ionut-arm mentioned this issue Oct 22, 2020
Merged
ionut-arm added a commit to ionut-arm/parsec that referenced this issue Oct 22, 2020
@ionut-arm
Remove PKCS11 single thread lock (parallaxsecond#264)
d2ab124 
This commit removes the mutex that was used to force the PKCS11 provider
to work in a single-threaded way. The issue was fixed in
softhsm/SoftHSMv2#576 and our Dockerfiles
have been updated to use that commit.

Signed-off-by: Ionut Mihalcea <ionut.mihalcea@arm.com>
ionut-arm added a commit to ionut-arm/parsec that referenced this issue Oct 22, 2020
@ionut-arm
Remove PKCS11 single thread lock (parallaxsecond#264)
23d9ee7 
This commit removes the mutex that was used to force the PKCS11 provider
to work in a single-threaded way. The issue was fixed in
softhsm/SoftHSMv2#576 and our Dockerfiles
have been updated to use that commit.

Signed-off-by: Ionut Mihalcea <ionut.mihalcea@arm.com>
ionut-arm added a commit to ionut-arm/parsec that referenced this issue Oct 22, 2020
@ionut-arm
Remove PKCS11 single thread lock (parallaxsecond#264)
44aa418 
This commit removes the mutex that was used to force the PKCS11 provider
to work in a single-threaded way. The issue was fixed in
softhsm/SoftHSMv2#576 and our Dockerfiles
have been updated to use that commit.

Signed-off-by: Ionut Mihalcea <ionut.mihalcea@arm.com>
ionut-arm added a commit to ionut-arm/parsec that referenced this issue Oct 22, 2020
@ionut-arm
Remove PKCS11 single thread lock (parallaxsecond#264)
4255a98 
This commit removes the mutex that was used to force the PKCS11 provider
to work in a single-threaded way. The issue was fixed in
softhsm/SoftHSMv2#576 and our Dockerfiles
have been updated to use that commit.

Signed-off-by: Ionut Mihalcea <ionut.mihalcea@arm.com>
ionut-arm added a commit to ionut-arm/parsec that referenced this issue Oct 22, 2020
@ionut-arm
Remove PKCS11 single thread lock (parallaxsecond#264)
3c7afeb 
This commit removes the mutex that was used to force the PKCS11 provider
to work in a single-threaded way. The issue was fixed in
softhsm/SoftHSMv2#576 and our Dockerfiles
have been updated to use that commit.

Signed-off-by: Ionut Mihalcea <ionut.mihalcea@arm.com>
ionut-arm added a commit that referenced this issue Oct 22, 2020
@ionut-arm
Merge pull request #277 from ionut-arm/pkcs11-multithread
364eca0 
Remove PKCS11 single thread lock (#264)
@ionut-arm ionut-arm mentioned this issue Jul 21, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ionut-arm ionut-arm

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Remove PKCS11 single thread lock (#264) ionut-arm/parsec
1 participant
@ionut-arm