Feedback-ID: i0fe9450f:Fastmail
Date: Tue, 4 Feb 2025 09:47:25 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Zixuan Fu <r33s3n6@gmail.com>, Yura Sokolov <y.sokolov@postgrespro.ru>,
	PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Optimize scram_SaltedPassword performance
Message-ID: <Z6FjnXFf69RKsLV9@paquier.xyz>
References: <Z6BsNAadbID+k2L4@bass1>
 <62fbf768-d2d0-4bb2-840d-a8d2880af82b@postgrespro.ru>
 <4ABFA50D-9558-4368-8A62-E2B78DE39E0B@yesql.se>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="8LaB8P/eGRVt0q4o"
Content-Disposition: inline
In-Reply-To: <4ABFA50D-9558-4368-8A62-E2B78DE39E0B@yesql.se>
Archived-At: <https://www.postgresql.org/message-id/Z6FjnXFf69RKsLV9%40paquier.xyz>
Precedence: bulk


--8LaB8P/eGRVt0q4o
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Mon, Feb 03, 2025 at 12:17:27PM +0100, Daniel Gustafsson wrote:
> The numbers are quite outdated but the gist of it holds.  If we speed it up
> serverside we need to counter that with a higher iteration count, and for a
> rogue client it's unlikely to matter since it wont use our code anyways.
> Speeding up HMAC for other usecases is a different story (but also likely to
> have less measurable performance impact).

Thanks, I've managed to somewhat forget this point.  Note that this
has come up as well when adding the GUC scram_iterations in
b577743000cd, where a lower count can be used for a faster connection.

> Storing any part of a cryptograhic calculation, let alone a key, in a static
> variable doesn't seem entirely like a best practice, and it also wont be
> threadsafe.

Agreed.

By the way, something I have forgotten to mention yesterday..  If a
fast-path gets implemented in these HMAC APIs (perhaps not), it sounds
to me that it would be better to achieve the same for the fallback
non-OpenSSL implementation in src/common/hmac.c, as it would reflect
things properly in the interface.  My 2c.
--
Michael

--8LaB8P/eGRVt0q4o
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmehY50ACgkQnvQgOdby
QH3/pw/7BEXXcGLSLLh6cZKEqj12oQmoU15OpjZ9/3s6CV55bLaSUnxStSfDw5FX
2rqEsDojdIfAVKmaIlwgoj5HKiV5+vhCvvRQP/Wjch5LTvT5/5r6rvs2RcjWr5Z/
kkvafyoeoc6xiVQ9HrU6YSrJY02C6UXgO/oloTBhEMw/BNpZWwAhTqiTKt6Z5lRB
4BkvIpXPL6eBSzeXLUniA12mx2Lyn5BmWW9nvrPqKmpKRX6g8Zj1Eslptotan4d8
UaVBxGeCNs5PAHEGs8h7Zbs+xWd+5UpwHDVEP/63dfnOnxzTMkhPx+3YHA2X7kB+
aV18D75c8c/hxe99K//eTZ/9KTMFoUfR6sjvGZR22+jpVK2s2tlUmeKT3O6ftRgU
BRr/AA9nsaR6Id3nPBax99tPCnuOt3eedpdc554w0+hJZGVb0nthDJE0kC3FU+oC
Rq2AJ2BXiBJKB/XOZl02My4Mr/thDS3ojXLcXkTykjRcXzIOTePQEVCffNtE+pS2
xbGGb2zyRmZPilNVxONyEnTQP27c3r2NcCWrHfJQ3HqAlR5P9U0v61dQHXrOHg5g
HJV0ln06kxzfOAInpuGA5Q4K8TSnklF7OPJ4/q2sxnJI+ijQRlPNemTBjEiu3htv
ChxBkDalX1GGx+kBdExn65JgJhljWFBTO7A/bFL5nGpAetLOjzQ=
=RqFr
-----END PGP SIGNATURE-----

--8LaB8P/eGRVt0q4o--