6 ms·

I ran into a speed issue last year messing around with Go RSA keys. Turns out it's an open bug. Even though fixes have been made (see links in the thread), it's

I ran into a speed issue last year messing around with Go RSA keys. Turns out it's an open bug. Even though fixes have been made (see links in the thread), it's not a global fix and Go ciphers can be absysmally slow. https://github.com/golang/go/issues/20058 https://github.com/golang/go/issues/20058 The recommended fix is to use a library like this one. However, that means your containers blow up with complicated dependency trees so it's not really a good solution for a distributed container architecture (eg Kubernetes). https://github.com/ncw/gmp https://github.com/ncw/gmp I love working with Go because of its simple binaries and small containers, but there are some things that it just does not do well.

dependenttypes 7y ago
I don't know if using gmp for RSA is a good idea. I am pretty sure that gmp would open you to side channel attacks due to its operations not being constant time.
- aseipp 7y ago
  GMP has constant time functions for the relevant primitives you'd need to implement RSA (notably, constant-time/space modular power functionality). You'll probably still fuck it up completely anyway if you're doing it yourself, but not because of that.
- grammarxcore 7y ago
  I abandoned the project because I couldn't find a reasonable solution using standard Go libs that worked in a reasonable timeframe. The bottleneck is this function. math/big.addMulVVW There was some work on it recently. https://go-review.googlesource.com/q/addMulVVW https://go-review.googlesource.com/q/addMulVVW But I feel like this issue might have been ignored. https://go-review.googlesource.com/c/go/+/164966 https://go-review.googlesource.com/c/go/+/164966 It might be addressed in Go 1.14 (although it's been marked as Backlog since I last looked at that issue). https://github.com/golang/go/issues/32492 https://github.com/golang/go/issues/32492 Point being Go, like OP of this thread suggests, has some issues. This is, to me, a critical flaw preventing my teams from using Go as a primary web language. It is both consistently faster and consistently timed to make an external call to, say, gpg2 to generate a key than it is to use the opengpg lib that relies on math/big. That's nuts.

dependenttypes 7y ago

I don't know if using gmp for RSA is a good idea. I am pretty sure that gmp would open you to side channel attacks due to its operations not being constant time.

aseipp 7y ago
GMP has constant time functions for the relevant primitives you'd need to implement RSA (notably, constant-time/space modular power functionality). You'll probably still fuck it up completely anyway if you're doing it yourself, but not because of that.
grammarxcore 7y ago
I abandoned the project because I couldn't find a reasonable solution using standard Go libs that worked in a reasonable timeframe. The bottleneck is this function. math/big.addMulVVW There was some work on it recently. https://go-review.googlesource.com/q/addMulVVW https://go-review.googlesource.com/q/addMulVVW But I feel like this issue might have been ignored. https://go-review.googlesource.com/c/go/+/164966 https://go-review.googlesource.com/c/go/+/164966 It might be addressed in Go 1.14 (although it's been marked as Backlog since I last looked at that issue). https://github.com/golang/go/issues/32492 https://github.com/golang/go/issues/32492 Point being Go, like OP of this thread suggests, has some issues. This is, to me, a critical flaw preventing my teams from using Go as a primary web language. It is both consistently faster and consistently timed to make an external call to, say, gpg2 to generate a key than it is to use the opengpg lib that relies on math/big. That's nuts.