<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0cm;
margin-right:0cm;
margin-bottom:8.0pt;
margin-left:0cm;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.StileMessaggioDiPostaElettronica17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="IT" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">Hi all,<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">we would like to have your help in order to understand the behavior of SoftHSM token described herein.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">We developed a multi-threaded, C++ implemented, FastCGI module for Apache embedding an instance of SoftHSM v2.0 token.
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">The service, named HBM (as per: HSM Broker Module) accept HTTP POST requests (for encryption and decryption), and is executed on a bare-metal DELL server R-710 model, with the following characteristics:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span style="font-family:"Courier New"">2 CPU 6-core Intel(R) Xeon(R) CPU E5645 @2.40GHz<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">Hyper-threading enabled<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">RAM: 96 GB @1333MHz DDR3 (8 GB banks)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">6 x 600 GB HDD in RAID 10, HW RAID (total end-user capacity: about 1.5 TBytes)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">Operating System: Centos 7.2 - 64 bit<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">The installed version of the SoftHSM package is:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">softhsm.x86_64 2.1.0-2.el7 @base<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">On another machine with the same characteristics, we sent into execution the Siege benchmarking utility, having populated the Siege input file with half HBM encryption commands, and half decryption ones.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">The Siege run lasts five minutes, and is executed at concurrency level set at 16; this is the command through which each Siege run is sent into execution:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">/home/kafka/siege/bin/siege -q -f/tmp/siege.in.$$ -l$PWD/h.log -m "$MESSAGE" -b -i –t300S –c16<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">Each encryption and decryption request is associated to a (AES-256-CBC) key identifier, but, in the test, we always used the same key identifier.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">A request to the service is taken in charge by a freshly created thread, to which is associated a private (but non-volatile) cache containing the PKCS#11 handle of the key to be used to satisfy the request.
Thus, we do not need to execute the C_FindObject() PKCS#11 routine for each request: after some requests, new threads are likely to find their private cache yet filled by a previously executed thread (which dies after the request is serviced).<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">We measured the throughput reported by Siege after modifications (keys added to or removed from the SoftHSM token), and we have the following table, where the “HBM reboot” boolean indicates if, before the
corresponding run, the HBM service was rebooted or not.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">Run ID | Number of keys | HBM reboot | Throughput<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""> 1 | 52 | Y | 12951.84<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""> 2 | 1 | N | 13456.31<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""> 3 | 52 | N | 3566.23<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""> 4 | 52 | Y | 12930.80<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""> 5 | 26 | N | 6427.34<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""> 6 | 38 | N | 4583.19<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""> 7 | 52 | N | 3505.33<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""> 8 | 52 | Y | 12865.59<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""> 9 | 26 | N | 6427.05<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""> 10 | 1 | N | 13310.76<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">As can be seen (going from run 2 to run 3) adding keys to the token without rebooting HBM causes a notable drop in throughput, and the same happens when removing keys (runs 4 to 5 and 8 to 9). However, when
only the (unique) used key is left in the token, the throughput rises again.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">This happens also when the HBM service is rebooted (runs 3 to 4, and 7 to 8).<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">We do not understand this behavior, and any hint to interpret it would be much appreciated.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">Regards,<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:normal">
<span lang="EN-US" style="font-family:"Courier New"">Marco Spadoni<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<font face="Arial" color="Gray" size="1"><br>
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify postmaster@italiaonline.it .<br>
www.italiaonline.it <br>
<br>
</font>
</body>
</html>