Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
Security IT Technology

A Rust-Based TLS Library Outperformed OpenSSL in Almost Every Category (zdnet.com) 213

A tiny and relatively unknown TLS library written in Rust, an up-and-coming programming language, outperformed the industry-standard OpenSSL in almost every major category. From a report: The findings are the result of a recent four-part series of benchmarks carried out by Joseph Birr-Pixton, the developer behind the Rustls library. The findings showed that Rustls was 10% faster when setting up and negotiating a new server connection, and between 20 and 40% faster when setting up a client connection. But while handshake speeds for new TLS connections are important, most TLS traffic relies on resuming previously negotiated handshakes. Here, too, Rustls outperformed the aging OpenSSL, being between 10 and 20% in resuming a connection on the server-side, and being between 30 and 70% quicker to resume a client connection. Furthermore, Rustls also fared better in sheer bulk performance -- or the speed at which data is transferred over the TLS connection. Birr-Pixton said Rustls could send data 15% faster than OpenSSL, and receive it 5% faster as well.
This discussion has been archived. No new comments can be posted.

A Rust-Based TLS Library Outperformed OpenSSL in Almost Every Category

Comments Filter:
  • Stop Already (Score:1, Insightful)

    by Anonymous Coward

    Stop pushing your Rust crap.

    • Stop pushing your Rust crap.

      But, but... they can push it 37% faster ...

      • by ls671 ( 1122017 )

        Probably because it was better coded. Associating languages with good programming skills is silly. Also, everybody knows that opensll has become a mess to maintain just like anything else that's got age.

    • by Anonymous Coward

      No! Solutions should always be pushed. If you don't like the solution attack the merits, not the exuberance.

  • by Anonymous Coward

    Because, lets face it, not as tested as OpenSSL.

    • by Anonymous Coward

      True, but it's written in a memory safe language, so exploits like heartbleed are far less likely to be possible.

    • by Anonymous Coward

      And features too.

      Of course you're gonna be faster,.if you leave out all the corner cases that grew over the years and are precisely the reason why the library is reliable and trusted!

      What an idiotic headline.

      Look! My ROT256 byte encryption is even faster than AES! --.--

      • What evidence do you have that it "leaves out all the corner cases"? Yes, Rustls doesn't support deprecated SSL versions, but OpenSSL *shouldn't* either.

  • More TLS libraries, please. Diversity matters.

  • by Anonymous Coward on Friday July 19, 2019 @03:19PM (#58953332)

    I don't give a fuck about 5% faster if it doesnt benefit from the decades of bugfixes that OpenSSL has.

    • by Anonymous Coward

      Yeah. If it wasn't for all those decades of bugfixes stuff like Heartbleed might happen. It's not like the fact that Rust can't compile such fuckups has any value, right?

    • by Anonymous Coward

      I don't give a fuck about 5% faster if it doesnt benefit from the decades of bugfixes that OpenSSL has.

      That seems like a silly attitude to have, on the face of it.

      OpenSSL initial release: Hooray!
      Bug found.
      "Okay, we fixed it. New release!"
      Bug found.
      "Fixed again! New release!"
      Fast forward decades...

      New project initial release: We learned from all OpenSSL's mistakes and avoided them
      Slashdot AC: "Well it must be crap, it's new and doesn't have decades of bugfixes"

      That's.. that's just not a logical response.

      • Actually it is because however much they might claim that they have learned from all the OpenSSL's mistakes they have still only entered the first step in your chain: "initial release: Hooray!", since it has not been put through the same amount of scrutiny as the OpenSSL code we can only assume that there are tons of lingering bugs.
  • by ArchieBunker ( 132337 ) on Friday July 19, 2019 @03:19PM (#58953334)

    LibreSSL?

    • Re:How about (Score:5, Insightful)

      by 93 Escort Wagon ( 326346 ) on Friday July 19, 2019 @03:45PM (#58953506)

      I imagine they didn't post any comparisons to LibreSSL because they wouldn't have looked good.

      I know I'm certainly gonna trust a product from the OpenBSD guys a lot more than some random Rust developer. Theo and company have a long, proven track record which demonstrates they understand security better than almost anyone else.

  • Buggier too? (Score:5, Insightful)

    by h4ck7h3p14n37 ( 926070 ) on Friday July 19, 2019 @03:20PM (#58953338) Homepage

    Various versions of OpenSSL have been audited by a third-party, has Rustls?

    Many, many people have been running OpenSSL for quite a long time and bugs have been found and corrected. Why should I have any confidence in this new project?

    • Re:Buggier too? (Score:4, Insightful)

      by Anonymous Coward on Friday July 19, 2019 @03:41PM (#58953480)

      Seriously, this is my concern. It's easy to be faster when you're doing things wrong, and there are SO MANY ways to screw up crypto. Sure, Rust is "memory safe," but that doesn't mean that it doesn't pick predictable keys, or that it doesn't leave itself vulnerable to side-channel attacks in some way, or any of the other numerous ways crypto can go wrong.

      People don't use OpenSSL because it's fast, they use it because it's well-tested.

      • Re:Buggier too? (Score:4, Informative)

        by serviscope_minor ( 664417 ) on Saturday July 20, 2019 @03:26AM (#58955532) Journal

        Seriously, this is my concern. It's easy to be faster when you're doing things wrong, and there are SO MANY ways to screw up crypto. Sure, Rust is "memory safe," but that doesn't mean that it doesn't pick predictable keys, or that it doesn't leave itself vulnerable to side-channel attacks in some way, or any of the other numerous ways crypto can go wrong.

        That's precisely what I was thinking, but the side channels in particular. I know crypto implementations do things intentionally in a suboptimal way so all paths take the same time and power in order to prevent leaking of the keys.

      • We thought it was "well-tested" before we found Heartbleed, too. Hours run in production do not necessarily correlate to correctness. That said, the performance numbers are just that: performance numbers. No one who knows anything about software is suggesting that everyone delete OpenSSL today and run out and install Rustls as their production TLS library. Of course, there's a Catch-22 somewhere there: OpenSSL wouldn't be as good as it is today if people didn't use it and contribute to its development, find

    • Re: (Score:2, Funny)

      by Anonymous Coward

      Various versions of OpenSSL have been audited by a third-party, has Rustls?

      Many, many people have been running OpenSSL for quite a long time and bugs have been found and corrected. Why should I have any confidence in this new project?

      Because Rust is a socially-aware, woke language.

      And not trusting it implicitly makes you a RAAAACIS'!!!!

    • by Anonymous Coward

      I'm glad someone said the obvious. OpenSSL has dark magic shit. It waits for randomized times, in weird places, all because the various side channel issues that have been found over the years.

      This highlights a larger issue: for important libraries like these, we have no safe means to move away because we have not consolidated the body of attacks into a testing suite.

      • Oh look, a programmer who thinks the only way to avoid bugs is with a testing suite. God help you I'd you ever have to write network code or threaded code, you're not going to be able to write a test for every case, you'll need to develop new techniques.
    • Despite many eyes over many years we are still finding bugs in OpenSSL. The appeal of using Rust is that the compiler itself prevents several classes of serious security bugs. That's why it's news (at least among security pros) to see widespread security critical libraries implemented in Rust.

      • Despite many eyes over many years we are still finding bugs in OpenSSL. The appeal of using Rust is that the compiler itself prevents several classes of serious security bugs.

        Because OpenSSL continues to support new features.

        The appeal of preventing some kinds of security issues isn't necessarily outweighed by heavily audited code with many eyeballs on it. Rust does not guarantee against design problems, and what OpenSSL does is extremely complex.

        I can't tell you how crazy it is that some people don't recognize that a lot of security comes from design and auditing, and no magic compiler bypasses those requirements.

        • Because of new features? On the contrary, we are still finding holes in OpenSSL that are many years old.

          If you think the mechanisms Rust uses to prevent security issues are "magic," you aren't familiar enough with the technology to comment on it.

        • by amorsen ( 7485 )

          I can't tell you how crazy it is that some people don't recognize that a lot of security comes from design and auditing, and no magic compiler bypasses those requirements.

          It is rather amusing that design and auditing is used as an argument FOR using openssl.

          openssl is a hobby project that the author created in order to learn about large number arithmetic.

    • Various versions of OpenSSL have been audited by a third-party, has Rustls?

      Yes and look where that got them, a security vulnerability so bad that a fork started in an effort to clean up the software. OpenSSL is a horrendous patchwork of legacy garbage. There's no reason to consider it secure just because it has gone through an audit. There is however reason to think that RusTLS may actually be *less* buggy thanks to less complexity and less garbage patchwork.

    • by roca ( 43122 )

      Track record is a fair concern. That's something that rustls can only acquire via real-world usage over time. Fortunately that track record is growing (e.g. we use rustls in our Web service).

      However, Rust gives rustls a big security advantage compared to OpenSSL or any other library written in C/C++. It's well-known that Rust ensures memory safety for the vast majority of the rustls code (that does not use 'unsafe'), but there's more to the story. Rust also prevents data races. Rust code built in debug mode

      • by Anonymous Coward

        However, Rust gives rustls a big security advantage compared to OpenSSL or any other library written in C/C++. It's well-known that Rust ensures memory safety for the vast majority of the rustls code (that does not use 'unsafe'),

        This is something I really hate. The blanket assumption RUST is memory safe when any particular codebase may well not be. As a minimum ring makes calls to assembler code that is not at all memory safe. Who knows what other tradeoffs are made at a low level within libraries. There should be a qualification regime to communicate the safety level otherwise the only prudent course of action is to operate under the assumption no rust code is memory safe.

        but there's more to the story. Rust also prevents data races.

        Compile time checking is only available for uninterestin

  • Speed isn't a bad thing per se, but it's not the most important thing in a cryptography library. What about side channel resistance?

    Also, OpenSSL isn't the be all and end all of SSL libraries. How does it compare to e.g. LibreSSL, which should also be faster than OpenSSL with all of the crap it's stripped out?

    • by skids ( 119237 )

      Feature set matters, too.

      AFAIK only OpenSSL is truly usable... though that's stretching the word "usable" a bit... outside
      run of the mill use cases. In particular, it would be interesting to know if this library could
      be used in a mature EAP authentication server implementation, some of the qualifications
      for which are mentioned here:

      http://lists.cistron.nl/piperm... [cistron.nl]

  • I'm sorry but when the developer of anything tests it it is always faster. So trust on my side isn't there as I am always skeptical. Its like trusting the government, you just don't. Now if this were an non-affiliated third party publishing these stats I might believe it more.
    • by jma05 ( 897351 )

      > Its like trusting the government, you just don't.

      I would trust government studies way more than industry studies, at least in US, generally speaking.

      • > Its like trusting the government, you just don't.

        I would trust government studies way more than industry studies, at least in US, generally speaking.

        So you trust the Democrats and Republicans? Show me where this is a good idea.

        • by Jeremi ( 14640 )

          So you trust the Democrats and Republicans? Show me where this is a good idea.

          Captain Obvious says: Politicians are not the government, and government workers are not politicians.

    • by jma05 ( 897351 )

      Also, it is an open source benchmark. What is there to not trust? Improve it if you see a defect. Rust is not even a commercial tool, nor are the TLS implementations. I think you are sticking in ideology where it does not belong.

      Didn't RTA, but the only question I have is whether it is a comprehensive library that can replace OpenSSL. Lightweight implementations do perform better because they don't cover everything.

  • Namely security? OpenSSL has seen extensive independent review. What has Rustls seen? Performance is irrelevant if security is not there.

    • OpenSSL has seen extensive independent review.

      And it's still riddled [cvedetails.com] with security flaws [openssl.org]. That's the trademark C Disadvantage.

      • by gweihir ( 88907 )

        Bullshit. You seem to be unable to read that CVE table. Also bullshit on any "C Disadvantage". The only disadvantage that C has is that is exposes bad coders more obviously.

        • Bullshit.

          LibreSSL [libressl.org] was forked from OpenSSL because OpenSSL's security was so bad they gave up on trying to fix it. You're very plainly not across these issues. Don't let your C zealotry blind you to obvious realities.

        • by Jeremi ( 14640 ) on Friday July 19, 2019 @10:26PM (#58955046) Homepage

          The only disadvantage that C has is that is exposes bad coders more obviously.

          ... and that's a pretty big disadvantage, considering that 90% of coders are bad all the time, and the remaining 10% of coders are bad some of the time.

          Anyone who thinks they are a good coder all the time is fooling themselves.

          • by gweihir ( 88907 )

            I do agree on that. But it is not a disadvantage of the language. And, unfortunately, these bad coders make about as severe and often worse mistakes in _other_ languages as well and Rust is no exception.

            • But it is not a disadvantage of the language.

              Of course it is. The tool has failed to anticipate and account for the practical realities of software engineering. It is not fit for purpose.

              • by gweihir ( 88907 )

                Of course you are wrong. And you also seem to be lacking any real understanding of software engineering. C is fit for purpose. But people like you are probably not.

                • I love your weak personal attacks. You make it clear that C has no future. No one sane is going to bank on C as a viable language for the rest of the 21st century. Microsoft has the right idea [zdnet.com]. Software security matters too much to entrust it to C. C is simply not up to the task.
  • Difference? (Score:5, Interesting)

    by jythie ( 914043 ) on Friday July 19, 2019 @03:34PM (#58953436)
    I would be curious as to where these speedups actually come from. Is it a better implementation? Did they cut some corners? Does it support fewer features so is smaller? Did it just remove historical bloat/growth? Is this a product of the language handling things automatically instead of by the programmer? Speed ups do not come from nowhere, and some of these reasons are more positive than others.
    • Re: (Score:2, Informative)

      by Anonymous Coward

      If you read the linked pages, you’d see that the openSSL is doing unneeded buffer copies & discarding then re-doing some crypto operations, which account for various parts of the worse performance.

      • So they ripped out years of accumulated side-channel mitigation strategies?
        Sweet! That should definitely speed things right the hell up. Those Rust programmers really know their shit.
        • by Anonymous Coward

          Unfortunately for you, conclusion jumping isn't an Olympic sport yet. You could easily qualify.

    • Does it support fewer features so is smaller?

      This. OpenSSL is a patchwork of support for everything. If the kitchen sink ran code, OpenSSL would have some support for it hacked in an ugly way. Remember Heartbleed? LibreSSL come out of that to clean up the OpenSSL code base in an attempt to improve performance and security. After deleting 100,000 lines of code they established that nothing at all had changed in the software. Sure it didn't work on VMS or Windows 95 anymore, but really.

  • by ByteSlicer ( 735276 ) on Friday July 19, 2019 @03:39PM (#58953470)

    So the developer of this library also created some benchmarks in which this library performs better than a legacy library?
    I would be a lot more impressed if the benchmarks were created and performed by an independent developer.
    Also, how much did this strip from the original implementation, and does it still perform all needed functionalities?
    Also, how do we know this new code doesn't contain vulnerabilities? Rust may protect against buffer overflows, but it will do nothing against using cryptographically weak algorithms, or things like timing attacks.
    The 10% or so speed improvements are not worth it if it's not 100% secure and feature complete.

    • and does it still perform all needed functionalities?

      What do you consider a needed function? VMS support? Socket support for Windows 9x? OpenSSL would add support for encryption on an abacus if you could automate it. Remember the LibreSSL project started with OpenSSL and removed 100,000 lines without breaking anything.

      I'm not surprised a newly coded alternative performs better.

      • What do you consider a needed function? VMS support? Socket support for Windows 9x? OpenSSL would add support for encryption on an abacus if you could automate it. Remember the LibreSSL project started with OpenSSL and removed 100,000 lines without breaking anything.

        Personally couldn't select LibreSSL if I wanted to given it doesn't support features I need: DTLS, TLS-SRP, TLS 1.3.

        Remember at the time LibreSSL was initially started thumbing thru changes having a good laugh at all the shit they were putting back after having just torn out. A reflection of general cluelessness and poor planning.

        It's one thing to redesign and architect a better library from existing code but really all LibreSSL ever amounted to was a poorly maintained fork of OpenSSL with a bunch of shit

        • Not to mention the stupid shit they did with the OpenSSL version i LibreSSL causing every single project to maintain stupid #ifdefs in order to be able to compile with both libraries.
  • by bob4u2c ( 73467 ) on Friday July 19, 2019 @03:57PM (#58953560)
    But looking at the results you see this note when comparing sending speeds:

    The difference between OpenSSL and rustls appears to be thanks to an extra copy in the main data-path in OpenSSL

    OpenSSL has one more memory copy operation, so the question is why? Is it a security risk, or just an optimization that hasn't been implemented? Given the age of the OpenSSL code, my money would be it is some kind of security risk.

    As for receiving the results are very close and the author notes that rustls implemented a few hardware accelerated optimizations which would account for the difference. So not really a "our language is better" kind of thing, just a we found an optimization. It might be worth taking a look at the rust code and seeing if those changes could be made to the existing OpenSSL packages.

    • by Anonymous Coward

      But looking at the results you see this note when comparing sending speeds:

      The difference between OpenSSL and rustls appears to be thanks to an extra copy in the main data-path in OpenSSL

      OpenSSL has one more memory copy operation, so the question is why? Is it a security risk, or just an optimization that hasn't been implemented? Given the age of the OpenSSL code, my money would be it is some kind of security risk.

      My money is on side channel attack mitigation. A lot of effort has been made that the functions execute in fixed time so you can't deduce code path information from execution time. This is something rust wont help you with. It also prevents speedups.

    • OpenSSL has one more memory copy operation, so the question is why? Is it a security risk, or just an optimization that hasn't been implemented? Given the age of the OpenSSL code, my money would be it is some kind of security risk.

      Given that it's written in C, my money would be that it's an artifact of a memory management strategy.

      In a language without GC, you are confronted with memory allocation lifetime issues all the time. And sometimes it's just easier to make an extra copy.

  • Look at the assembly output produced by each. What optimizations is the rust compiler making that you (apparently) can't reasonably do in C?
  • OpenSSL is a poster child for bloat, cruft, and the weight of accumulated decades. I'm not really blaming it, because that's just what happens over time, but nobody expects it to be performant.

    It's good to know the a Rust version that does the same useful bits actually is faster, but it would be interesting to see it compared to something like mbed or the other rewrites that have appeared since the giant OpenSSL crisis.

  • by ledow ( 319597 )

    Anyone who's ever read the OpenSSL code won't be surprised.

    When I looked at it a few years ago (before their last major feck-up) I'd never seen such a mess of undocumented, incompletely described, un-maintainble junk in my life.

    I realise that speed is second to security, but you could rewrite OpenSSL in Microsoft BASIC and probably churn out something quicker, more reliable and more readable.

    • When I looked at it a few years ago (before their last major feck-up) I'd never seen such a mess of undocumented, incompletely described, un-maintainble junk in my life.

      Which is the stated reason why the OpenBSD guys forked the codebase and started LibreSSL.

      OS X / MacOS switched to LibreSSL several years back. I know there's a lot of antipathy in the Linux community against the OpenBSD group, but I wouldn't be surprised if the big Linux distros let their pragmatism override their biases and eventually adopt it as well. It's not GPL licensed, but neither is OpenSSL.

  • Software written just now may be faster in some ways than software written years ago? WHAT A SHOCKING SUPRISE
  • by Anonymous Coward

    There is a reason a proper SSL implementation is slow: all code paths need to be equally slow in order to prevent side channel attacks. Make half of them faster, and the program is more efficient. Also you can read its operations like a book.

  • by rebill ( 87977 ) on Friday July 19, 2019 @05:41PM (#58954096) Journal

    One of the attacks against encryption systems is to see how long it takes to fail to decrypt in various circumstances.

    If every single decryption failure takes the same amount of time, no information is leaked when someone starts battering the library. However, if it fails faster when the first character of the key is bad, then all an attacker has to do is try combinations until they get a fast response ... and now they have the first part of the key. Repeat on the second, then the third, and so on.

    In that scenario, cracking the key drops from X**N (some time raised to the power of how long the key is) down to X*N (the same time multiplied by the length of the key).

    I have no idea if this particular Rust library has that problem. But I am skeptical of anything so utterly focused on speed. Just ask Intel about Specter.

  • by rebill ( 87977 )

    ... until they get a slower response ...

  • And a newly created tls library written in c outperforms the rustls library.... Does the rustls library handle all situations or is it taking shortcuts. OpenSSL has been built over decades now, so ofcourse it is propably slower, but if it was completely rebuild from the ground up in c with everything we know now, it will outperform rustls without a problem.
  • Speed only (in this case, throughput was improved by improving latency through serial code paths). This disregards e.g. timing attack resistance, handling of unusual cases, and the big one, portability. Rust simply doesn't run on e.g. Xtensa or OpenRISC. How many applications do you have where crypto speed is a dominating bottleneck yet not hardware supported? That's not to say there aren't advantages to doing this task in Rust; simply relatively limited applications.
  • After ten years of security patches, how will it perform?

  • It's not pure Rust (Score:4, Insightful)

    by jeremyp ( 130771 ) on Sunday July 21, 2019 @06:44AM (#58959682) Homepage Journal

    If you look at the developer's GitHub page, it says it has a dependency on a thing called "ring" for cryptography. The ring page [github.com] says

    ring is focused on the implementation, testing, and optimization of a core set of cryptographic operations exposed via an easy-to-use (and hard-to-misuse) API. ring exposes a Rust API and is written in a hybrid of Rust, C, and assembly language.

    This is not quite the triumph for Rust the story claims.

     

An Ada exception is when a routine gets in trouble and says 'Beam me up, Scotty'.

Working...