RustCrypto / RustCrypto/rustls-rustcrypto
>600ms hangup with RSA signed certs
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 130
- Forks
- 21
- Avg merge
- 18h 6m
- Merged PRs (30d)
- 1
Description
made a quick server toy that just prints out UwU anyone connecting to show the 600ms delay
https://github.com/pinkforest/tls_neg_loiter
- add
loiter.rustcryp.tointo your hosts for your 127.0.0.1 loopback - cd certs;make rsa4096
- cd ..; cargo run (to run the mock server)
openssl s_client -crlf -servername loiter.rustcryp.to -CAfile certs/ca.rsa4096.crt 127.0.0.1:828(shows delay after CONNECTED)- connect with firefox with network console and also see (server doesn't multiplex so ensure you close the openssl before)
This only happens with issues signed with rsa but it doesn't happen with prime256v1 etc. these only have 1-3 ms latency
Also doesn't happen with aws-lc-rs with either rsa4096 / prime256v1
Probably good idea to bump RSA...
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the reproduction steps and the linked tls_neg_loiter toy server, using the certs/Makefile target rsa4096 and the cargo run server. Compare the openssl s_client and Firefox behavior for RSA certificates against prime256v1 and aws-lc-rs. Done means the reported RSA-related delay is understood and no longer occurs, with the differing cases accounted for.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100