[SOLVED] Tor and openSSL.

cwizardone · 06-10-2014, 09:44 PM

I was looking at the message log in the Vidalia control panel and noticed this,

Quote:

We were built to run on a 64-bit CPU with openSSL 1.0.1 or later, but with a version of openSSL that apparently lacks accelerated support of NIST P-224 and P-256 groups. Building openssl with such support (using the enable-ec_nistp_64_gcc_128 option when configuring it) would make ECDH much faster.

The above is not worded very well, so I'm not sure what exactly it is saying, but let me take a guess. Is it saying, that the -current version of openSSL lacks support for "NIST P-224 and P-256 groups," and if openSSL were to be rebuilt with "ec_nistp_64_gcc_128" enabled, it would perform better, that is, faster?

Thanks.

orasis · 06-10-2014, 10:00 PM

The difference would be imperceptible to a human. Leave it alone.

mancha · 06-10-2014, 10:52 PM

Hi.

On a 64-bit system, enabling the OpenSSL NIST 64-bit optimization should result in considerable speed improvements when using
curves: NIST-P224, NIST-P256, and NIST-P521.

You can test this by running the following with and without 64-bit optimization:

Code:

$ openssl speed ecdsap224

On a test system, I get a 60% increase in signings/second and about 190% increase in verifications/second. An additional benefit
is that the 64-bit optimized code uses constant-time multiplications thereby making it more resistant to timing attacks.

I've not sent Pat an email suggesting he adopt this for Slackware64 but I did endorse its usage in another LQ thread.

The change is simple. Get the official Slackware64 build files and edit openssl.SlackBuild by adding the line in red:

Code:

./config \
 --prefix=/usr \
 --openssldir=/etc/ssl \
 enable-ec_nistp_64_gcc_128 \
 no-idea \
 no-rc5 \
 no-sse2 \
 shared

--mancha

cwizardone · 06-10-2014, 11:41 PM

@mancha,
Thank you very much!