diff options
| -rw-r--r-- | security/nss/lib/softoken/lowpbe.c | 77 | ||||
| -rw-r--r-- | security/nss/lib/softoken/pkcs11.c | 7 |
2 files changed, 83 insertions, 1 deletions
diff --git a/security/nss/lib/softoken/lowpbe.c b/security/nss/lib/softoken/lowpbe.c index 4a101c68c..86b55fd9b 100644 --- a/security/nss/lib/softoken/lowpbe.c +++ b/security/nss/lib/softoken/lowpbe.c @@ -18,6 +18,7 @@ #include "alghmac.h" #include "softoken.h" #include "secerr.h" +#include "pkcs11i.h" SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate) @@ -553,6 +554,52 @@ loser: return A; } +/* Bug 1606992 - Cache the hash result for the common case that we're + * asked to repeatedly compute the key for the same password item, + * hash, iterations and salt. */ +static PZLock *PBE_cache_lock = NULL; +static SECItem *cached_PBKDF2_item = NULL; +static HASH_HashType cached_hashType; +static int cached_iterations; +static int cached_keyLen; +static SECItem *cached_salt = NULL; +static SECItem *cached_pwitem = NULL; + +void +sftk_PBELockInit(void) +{ + if (!PBE_cache_lock) { + PBE_cache_lock = PZ_NewLock(nssIPBECacheLock); + } +} + +static void +sftk_clearPBECacheItems(void) +{ + if (cached_PBKDF2_item) { + SECITEM_FreeItem(cached_PBKDF2_item, PR_TRUE); + cached_PBKDF2_item = NULL; + } + if (cached_salt) { + SECITEM_FreeItem(cached_salt, PR_TRUE); + cached_salt = NULL; + } + if (cached_pwitem) { + SECITEM_FreeItem(cached_pwitem, PR_TRUE); + cached_pwitem = NULL; + } +} + +void +sftk_PBELockShutdown(void) +{ + if (PBE_cache_lock) { + PZ_DestroyLock(PBE_cache_lock); + PBE_cache_lock = 0; + } + sftk_clearPBECacheItems(); +} + /* * generate key as per PKCS 5 */ @@ -596,7 +643,35 @@ nsspkcs5_ComputeKeyAndIV(NSSPKCS5PBEParameter *pbe_param, SECItem *pwitem, break; case NSSPKCS5_PBKDF2: - hash = nsspkcs5_PBKDF2(hashObj, pbe_param, pwitem); + PZ_Lock(PBE_cache_lock); + if (cached_PBKDF2_item) { + if (pbe_param->hashType == cached_hashType && + pbe_param->iter == cached_iterations && + pbe_param->keyLen == cached_keyLen && + cached_salt && + SECITEM_ItemsAreEqual(&pbe_param->salt, cached_salt) && + cached_pwitem && + SECITEM_ItemsAreEqual(pwitem, cached_pwitem)) { + hash = SECITEM_DupItem(cached_PBKDF2_item); + } else { + sftk_clearPBECacheItems(); + } + } + PZ_Unlock(PBE_cache_lock); + if (!hash) { + hash = nsspkcs5_PBKDF2(hashObj, pbe_param, pwitem); + PZ_Lock(PBE_cache_lock); + /* ensure no other thread was quicker than us setting the cache */ + if (!cached_PBKDF2_item) { + cached_PBKDF2_item = SECITEM_DupItem(hash); + cached_hashType = pbe_param->hashType; + cached_iterations = pbe_param->iter; + cached_keyLen = pbe_param->keyLen; + cached_salt = SECITEM_DupItem(&pbe_param->salt); + cached_pwitem = SECITEM_DupItem(pwitem); + } + PZ_Unlock(PBE_cache_lock); + } if (getIV) { PORT_Memcpy(iv->data, pbe_param->ivData, iv->len); } diff --git a/security/nss/lib/softoken/pkcs11.c b/security/nss/lib/softoken/pkcs11.c index 7f3a01746..6c535cf77 100644 --- a/security/nss/lib/softoken/pkcs11.c +++ b/security/nss/lib/softoken/pkcs11.c @@ -3097,6 +3097,9 @@ sftk_closePeer(PRBool isFIPS) return; } +extern void sftk_PBELockInit(void); +extern void sftk_PBELockShutdown(void); + /* NSC_Initialize initializes the Cryptoki library. */ CK_RV nsc_CommonInitialize(CK_VOID_PTR pReserved, PRBool isFIPS) @@ -3113,6 +3116,8 @@ nsc_CommonInitialize(CK_VOID_PTR pReserved, PRBool isFIPS) ENABLE_FORK_CHECK(); + sftk_PBELockInit(); + rv = SECOID_Init(); if (rv != SECSuccess) { crv = CKR_DEVICE_ERROR; @@ -3293,6 +3298,8 @@ nsc_CommonFinalize(CK_VOID_PTR pReserved, PRBool isFIPS) /* clean up the default OID table */ SECOID_Shutdown(); + sftk_PBELockShutdown(); + /* reset fork status in util */ UTIL_SetForkState(PR_FALSE); |