Provision to add complete record processing in OpenSSL about openssl HOT 4 OPEN

There is some limited support for this already via the so-called "stitched" ciphers. I say limited because the support is only for certain ciphersuites and only when Encrypt-Then-Mac is not in use. This is mostly a legacy feature that has not been updated for Encrypt-Then-Mac. See for example:

The idea here is that certain composite cipher + MAC combinations are treated like a single AEAD cipher. These are very much "special" ciphersuites and are treated slightly differently to other ciphersuites.

Generally there has not been much interest in pursuing this idea since in recent years AEAD ciphers are the preferred approach so you do not have this split of separate cipher and MAC stages. It is also preferred to try and keep the ciphers "standard" without having special case TLS knowledge inside the cipher implementation. Since all TLSv1.3 ciphersuites are AEAD anyway and the most preferred TLSv1.2 ciphersuites are also AEAD the benefits are small.

from openssl.

Hi Matt,
Thanks for your reply.
I have seen this stitched cipher implementation earlier. Still this is just a (enc+mac) operation together. It doesn't do any addition of padding, record header to the payload on TX and removal of padding, record header stripping on RX. I am trying to see all of this can be cooked into this new feature.

from openssl.

Hi @mattcaswell ,
As part of our next exercise, we plan to do code profiling in the code. The goal of this exercise is to quantify the benefits of adding complete record processing feature by measuring cycles of each of these record APIs. If we can provide the performance benefits of this feature, can we plan this feature for future release?

from openssl.

As part of our next exercise, we plan to do code profiling in the code. The goal of this exercise is to quantify the benefits of adding complete record processing feature by measuring cycles of each of these record APIs. If we can provide the performance benefits of this feature, can we plan this feature for future release?

We would of course be interested in seeing any statistics you have on a performance benefit. I can't say whether we would include such a feature or not. We would need to consider the potential benefits weighed against how invasive or extensive the changes are, and how many people are likely to see the benefits.

from openssl.