Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

[macOS] Specify kSecUseDataProtectionKeychain when generating RSA/ECC keys#52759

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
bartonjs merged 1 commit intodotnet:mainfromfilipnavara:macos-keygen
Jun 3, 2021

Conversation

@filipnavara
Copy link
Member

@ghost
Copy link

Tagging subscribers to this area:@bartonjs,@vcsjones,@krwq,@GrabYourPitchforks
See info inarea-owners.md if you want to be subscribed.

Issue Details

Fixes#36107.
Ref:#36107 (comment)

Author:filipnavara
Assignees:-
Labels:

area-System.Security

Milestone:-

@vcsjones
Copy link
Member

Did you actually see improvements in benchmarks?

I'm a bit behind in responding to issues, but I did give this a shot and I did not see an improvement in performance.

@filipnavara
Copy link
MemberAuthor

I'll re-run the benchmarks to make double sure that it takes the right code path.

@filipnavarafilipnavara marked this pull request as draftMay 14, 2021 13:25
@filipnavara
Copy link
MemberAuthor

filipnavara commentedMay 14, 2021•
edited
Loading

BenchmarkDotNet=v0.12.1.20210514-develop, OS=macOS Big Sur 11.3 (20E232) [Darwin 20.4.0]
Apple M1 2.40GHz, 1 CPU, 8 logical and 8 physical cores
.NET SDK=6.0.100-preview.3.21202.5
[Host] : .NET 6.0.0 (6.0.21.20104), X64 RyuJIT
Job-AAEMFC : .NET 6.0.0 (42.42.42.42424), X64 RyuJIT
Job-DJNIOL : .NET 6.0.0 (42.42.42.42424), X64 RyuJIT

MethodJobToolchainConfigMeanErrorStdDevRatioGen 0Gen 1Gen 2Allocated
SignHashJob-AAEMFCbranchnistP256, SHA256376.8 us1.03 us0.86 us0.07---248 B
SignHashJob-DJNIOLmainnistP256, SHA2565,700.9 us53.82 us47.71 us1.00---253 B
VerifyHashJob-AAEMFCbranchnistP256, SHA256493.8 us3.21 us2.85 us0.04---1,337 B
VerifyHashJob-DJNIOLmainnistP256, SHA25611,277.0 us164.62 us137.47 us1.00---1,341 B
SignHashJob-AAEMFCbranchnistP384, SHA3841,497.6 us20.16 us17.88 us0.13---313 B
SignHashJob-DJNIOLmainnistP384, SHA38411,503.5 us105.37 us93.41 us1.00---322 B
VerifyHashJob-AAEMFCbranchnistP384, SHA3841,524.5 us10.95 us9.71 us0.07---1,369 B
VerifyHashJob-DJNIOLmainnistP384, SHA38423,298.7 us252.31 us223.67 us1.00---1,388 B
SignHashJob-AAEMFCbranchnistP521, SHA5121,540.2 us20.36 us19.05 us0.07---393 B
SignHashJob-DJNIOLmainnistP521, SHA51223,319.9 us123.77 us109.72 us1.00---404 B
VerifyHashJob-AAEMFCbranchnistP521, SHA5121,606.7 us13.24 us12.39 us0.03---1,409 B
VerifyHashJob-DJNIOLmainnistP521, SHA51246,410.1 us150.48 us117.48 us1.00---1,465 B

(ignore the "allocated" column; the branch is few commits apart from themain one; both are x64 Debug build running under Rosetta)

@filipnavarafilipnavara marked this pull request as ready for reviewMay 14, 2021 14:03
@vcsjones
Copy link
Member

Woohoo.

@filipnavara
Copy link
MemberAuthor

filipnavara commentedMay 14, 2021•
edited
Loading

The failures with iOS.Simulator.Aot.Test on iOS / MacCatalyst could be related but there's not enough info in the logs. If I remember correctly these tests were enabled quite recently (this week) so it's possible that it may be just a coincidence.

Looks like the tests fail on all the recent PRs, so the failures are unrelated.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The Apple docs for this are... lacking. What's the effect? Does this let us get rid of the temporary keychains, and therefore make ephemeral load work?

If someone does PersistKeySet (where we load it into the default keychain for them) does this do anything weird?

Copy link
MemberAuthor

@filipnavarafilipnavaraMay 14, 2021•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The temporary keychains were already removed here in previous PR (#51620) that unified the key generation between iOS and macOS. However, by default macOS still generates ephemeral legacy CSSM keys that could be imported into (legacy) keychains. This attribute causes the code to create the iOS-style data keys instead. They don't interoperate with the legacy keychain SecItem* APIs well but that's never directly used in .NET (X509Certificate2.CopyWithPrivateKey will go through export and re-import using old APIs).

Copy link
MemberAuthor

@filipnavarafilipnavaraMay 14, 2021•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Note that the attribute existed in earlier macOS versions under the namekSecAttrNoLegacy which was more fitting (but private API).

@filipnavara
Copy link
MemberAuthor

RSA key generation benchmark

BenchmarkDotNet=v0.12.1.20210515-develop, OS=macOS Big Sur 11.3 (20E232) [Darwin 20.4.0]
Apple M1 2.40GHz, 1 CPU, 8 logical and 8 physical cores
.NET SDK=6.0.100-preview.3.21202.5
[Host] : .NET 6.0.0 (6.0.21.20104), X64 RyuJIT
Job-VMVYPG : .NET 6.0.0 (42.42.42.42424), X64 RyuJIT
Job-FZFMXK : .NET 6.0.0 (42.42.42.42424), X64 RyuJIT

MethodJobToolchainKeySizeMeanErrorStdDevMedianRatioRatioSDGen 0Gen 1Gen 2Allocated
GenerateKeyJob-VMVYPGbranch102422.68 ms0.618 ms1.813 ms22.62 ms0.470.09---4 KB
GenerateKeyJob-FZFMXKmain102449.74 ms3.082 ms9.038 ms49.04 ms1.000.00---4 KB
GenerateKeyJob-VMVYPGbranch2048196.33 ms21.201 ms61.846 ms185.20 ms0.660.49---6 KB
GenerateKeyJob-FZFMXKmain2048427.20 ms83.391 ms241.932 ms392.75 ms1.000.00---7 KB
GenerateKeyJob-VMVYPGbranch40962,437.88 ms529.845 ms1,537.176 ms1,974.58 ms0.901.43---12 KB
GenerateKeyJob-FZFMXKmain40964,527.22 ms894.447 ms2,537.396 ms4,167.44 ms1.000.00---12 KB

@bartonjs
Copy link
Member

While many PRs are failing on building MacCatalyst and iOSSimulator, I can't bring myself to accept a merge here with that being true, since I can't convince myself that the __builtin_available / kSecUseDataProtectionKeychain aren't related.

@filipnavara
Copy link
MemberAuthor

The problem with MacCatalyst / iOSSimulator should be fixed inmain. Re-running the tests should succeeded.

@filipnavara
Copy link
MemberAuthor

/azp run runtime-staging

@filipnavara
Copy link
MemberAuthor

Apparently the build was still picking the broken Mono :-/ I expected it to build the PR merge commit and not the PR tip commit.

I rebased it, so let's try again...

@steveisok
Copy link
Member

@bartonjs Can you give this another review?

@bartonjsbartonjs merged commit4275561 intodotnet:mainJun 3, 2021
@ghostghost locked asresolvedand limited conversation to collaboratorsJul 3, 2021
@filipnavarafilipnavara deleted the macos-keygen branchJune 5, 2025 07:41
Sign up for freeto subscribe to this conversation on GitHub. Already have an account?Sign in.

Reviewers

@bartonjsbartonjsbartonjs approved these changes

Assignees

No one assigned

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

ECDsa.VerifyData Performance Slow on Mac

4 participants

@filipnavara@vcsjones@bartonjs@steveisok
[8]ページ先頭
©2009-2025 Movatter.jp