From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by mx.groups.io with SMTP id smtpd.web11.12291.1679027327871365227 for ; Thu, 16 Mar 2023 21:28:49 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="unable to parse pub key" header.i=@intel.com header.s=intel header.b=IrByGO4Q; spf=pass (domain: intel.com, ip: 134.134.136.126, mailfrom: yi1.li@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1679027328; x=1710563328; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=0q8iEdJMA4TYQaI+P1CvK+LRsS1GKsfakl085nL0Xgc=; b=IrByGO4Qg0jqsH6IFDRK/QzK6D1oWgq0hGS6PRvawf2KPmAktdG+wtWK uJE+Pi0C6JlF+DDkRHMhr4fr68DFO7+nAMSjWTRhDt0i6jbrraagxwTPZ uZ4vmNS9tG8/hxm6VIdL0kZIK3dpxiovTmv67uAvBiPfXfcsjN7T2fWnI lHt3zDSV6lepxlqYDVzuuRiPvoisuYMBzzYQV6Wymu576NZlhniVzXkxj rF4TWTcPhdbSRzc1tTkM5wGTCIgkdoknIr6cHhQKVYl2VDKniMPeHIJwW z21xF2/G3U3ubXLlwJBBneFlu3SFkuUN3HvsQTCTkJpJ/Ijf4SpSqJ7Do A==; X-IronPort-AV: E=McAfee;i="6600,9927,10651"; a="322029724" X-IronPort-AV: E=Sophos;i="5.98,267,1673942400"; d="scan'208";a="322029724" Received: from orsmga003.jf.intel.com ([10.7.209.27]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Mar 2023 21:28:39 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10651"; a="630153811" X-IronPort-AV: E=Sophos;i="5.98,267,1673942400"; d="scan'208";a="630153811" Received: from liyi4-desktop.ccr.corp.intel.com ([10.239.153.82]) by orsmga003-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Mar 2023 21:28:38 -0700 From: "Li, Yi" To: devel@edk2.groups.io Cc: Yi Li Subject: [edk2-staging/OpenSSL11_EOL 4/7] Readme: 0315 update Date: Fri, 17 Mar 2023 12:28:16 +0800 Message-Id: <4affc0f9504ad7f1a2164ad3877eb6ed4a8d41b6.1679026329.git.yi1.li@intel.com> X-Mailer: git-send-email 2.31.1.windows.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Signed-off-by: Yi Li --- CryptoPkg/Readme-OpenSSL3.0.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/CryptoPkg/Readme-OpenSSL3.0.md b/CryptoPkg/Readme-OpenSSL3.0.md index 8a0fc6afb0..3d4afa8ac1 100644 --- a/CryptoPkg/Readme-OpenSSL3.0.md +++ b/CryptoPkg/Readme-OpenSSL3.0.md @@ -21,14 +21,14 @@ Will update latest result here (Build based on Intel platform). |-----------------|------------|------------|------------| |CryptoPei | 386 | 398 | 3.1% | |CryptoPeiPreMem | 31 | 31 | 0% | -|CryptoDxe | 804 | 917 | 14% | -|CryptoSmm | 558 | 636 | 14% | +|CryptoDxe | 804 | 886 | 10.1% | +|CryptoSmm | 558 | 604 | 8.2% | | LZMA Compressed | 1.1.1 | 3.0 | percent | |-----------------|------------|------------|------------| -|CryptoDxe | 311 | 360 | 15% | -|CryptoSmm | 211 | 248 | 17% | -|FV (Dxe+Smm) | 357 | 423 | 18% | +|CryptoDxe | 311 | 350 | 12.2% | +|CryptoSmm | 211 | 238 | 12.8% | +|FV (Dxe+Smm) | 357 | 412 | 15.4% | ## Limitation @@ -64,11 +64,10 @@ MD5 --> PEM --> CryptoPem(Ec\RsaGetPrivateKeyFromPem): used in Pkcs7Sign and Uni ### 3.Disable algorithm auto init Add -DOPENSSL_NO_AUTOALGINIT will disable OpenSsl from adding all digests and ciphers at initialization time. -Can reduce the size by ~20KB. +Can reduce the size by 27KB. #### Risk: OPENSSL_NO_AUTOALGINIT Will break PKCS7, Authenticode and Ts due to OpenSsl bug: https://github.com/openssl/openssl/issues/20221 -Currently only available when compiling PEI. ### 4.Cut Name/NID mapping There are some unreasonably huge arrays(~110KB) in the obj_dat.h and obj_xref.h, like: @@ -79,6 +78,7 @@ Removing unnecessary data can reduce the size by ~50KB. 1. DXE and SMM use more functions than PEI, so can only reduce fewer size. 2. Need a detailed script or readme. The best way is to automatically cut through openssl config, raised issue in community: https://github.com/openssl/openssl/issues/20260 +3. Will break Authticode API if applied to DXE SMM. ### 5.Hash API downgrade (for PeiPreMem) High level API (EVP) will introduce provider and NID mapping which can increase size extremely. @@ -97,8 +97,10 @@ This will become workaround if openssl doesn't accept such changes. https://github.com/liyi77/openssl/commits/openssl-3.0-POC Such as: remove x509 print function - 7KB -remove unused ras ameth - 7KB +remove unused rsa ameth - 7KB remove unused x509 extentions - 19KB +remove unused bio enc - 3KB +remove unused bio prov - 4KB ... #### Risk: This is workaround. -- 2.31.1.windows.1