Add different certificate signature algorithms to benchmarks

bindings/rust/bench/README.md

@@ -20,7 +20,7 @@ To remove external factors, we use custom IO with our benchmarks, bypassing the
 
 ### Certificate generation
 
-All certs are stored in `certs/` and can be regenerated using `certs/generate_certs.sh`. There is one root cert that directly signs the server and client certs that are used in benchmarking. Currently, we use ECDSA with `secp384r1`.
+All certs are stored in `certs/` and can be regenerated using `certs/generate_certs.sh`. There is one root cert that directly signs the server and client certs that are used in benchmarking. We currently bench RSA and ECDSA certs.
 
 ### Negotiation parameters
 

bindings/rust/bench/benches/handshake.rs

@@ -5,7 +5,9 @@ use bench::{
     CryptoConfig,
     ECGroup::{self, *},
     HandshakeType::{self, *},
-    OpenSslHarness, RustlsHarness, S2NHarness, TlsBenchHarness,
+    OpenSslHarness, RustlsHarness, S2NHarness,
+    SigType::{self, *},
+    TlsBenchHarness,
 };
 use criterion::{
     criterion_group, criterion_main, measurement::WallTime, BatchSize, BenchmarkGroup, Criterion,
@@ -17,15 +19,13 @@ pub fn bench_handshake_params(c: &mut Criterion) {
         bench_group: &mut BenchmarkGroup<WallTime>,
         handshake_type: HandshakeType,
         ec_group: ECGroup,
+        sig_type: SigType,
     ) {
         bench_group.bench_function(type_name::<T>(), |b| {
             b.iter_batched_ref(
                 || {
                     T::new(
-                        CryptoConfig {
-                            cipher_suite: Default::default(),
-                            ec_group,
-                        },
+                        CryptoConfig::new(Default::default(), ec_group, sig_type),
                         handshake_type,
                     )
                     .unwrap()
@@ -40,19 +40,30 @@ pub fn bench_handshake_params(c: &mut Criterion) {
 
     for handshake_type in [ServerAuth, MutualAuth] {
         for ec_group in [SECP256R1, X25519] {
-            let mut bench_group =
-                c.benchmark_group(format!("handshake-{:?}-{:?}", handshake_type, ec_group));
-            bench_handshake_for_library::<S2NHarness>(&mut bench_group, handshake_type, ec_group);
-            bench_handshake_for_library::<RustlsHarness>(
-                &mut bench_group,
-                handshake_type,
-                ec_group,
-            );
-            bench_handshake_for_library::<OpenSslHarness>(
-                &mut bench_group,
-                handshake_type,
-                ec_group,
-            );
+            for sig_type in [Rsa2048, Rsa3072, Rsa4096, Ec384] {
+                let mut bench_group = c.benchmark_group(format!(
+                    "handshake-{:?}-{:?}-{:?}",
+                    handshake_type, ec_group, sig_type
+                ));
+                bench_handshake_for_library::<S2NHarness>(
+                    &mut bench_group,
+                    handshake_type,
+                    ec_group,
+                    sig_type,
+                );
+                bench_handshake_for_library::<RustlsHarness>(
+                    &mut bench_group,
+                    handshake_type,
+                    ec_group,
+                    sig_type,
+                );
+                bench_handshake_for_library::<OpenSslHarness>(
+                    &mut bench_group,
+                    handshake_type,
+                    ec_group,
+                    sig_type,
+                );
+            }
         }
     }
 }

bindings/rust/bench/benches/throughput.rs

@@ -24,10 +24,7 @@ pub fn bench_throughput_cipher_suite(c: &mut Criterion) {
             b.iter_batched_ref(
                 || {
                     let mut harness = T::new(
-                        CryptoConfig {
-                            cipher_suite,
-                            ec_group: Default::default(),
-                        },
+                        CryptoConfig::new(cipher_suite, Default::default(), Default::default()),
                         Default::default(),
                     )
                     .unwrap();

bindings/rust/bench/certs/ec384/ca-cert.pem

@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICTjCCAdQCFCI17v5gV4ghuGIAMZ/4URS3uOyMMAoGCCqGSM49BAMCMIGJMQsw
+CQYDVQQGEwJKUDEOMAwGA1UECAwFQ2hpYmExEzARBgNVBAcMCkNoaWJhIENpdHkx
+GDAWBgNVBAoMD1Rlc3NpZXItQXNocG9vbDEYMBYGA1UEAwwPZGV2ZWxvcC5sb2Nh
+bGNhMSEwHwYJKoZIhvcNAQkBFhJjYUBkZXZlbG9wLmxvY2FsY2EwIBcNMjMwNjIw
+MTc0OTMwWhgPMjIwMjExMjUxNzQ5MzBaMIGJMQswCQYDVQQGEwJKUDEOMAwGA1UE
+CAwFQ2hpYmExEzARBgNVBAcMCkNoaWJhIENpdHkxGDAWBgNVBAoMD1Rlc3NpZXIt
+QXNocG9vbDEYMBYGA1UEAwwPZGV2ZWxvcC5sb2NhbGNhMSEwHwYJKoZIhvcNAQkB
+FhJjYUBkZXZlbG9wLmxvY2FsY2EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQBa11l
+hdlPfuEwoEDyQVjMAfwjBvNYPiHoSzFgcTvEmjqEnTC+ZaOnPb+gJ+mk1ZUgmXpG
+woEGhY+Z9IIiaZWfW9NRrPUabh5SlUh+t76NUNX7xzukGHUlTJNBQmD34pAwCgYI
+KoZIzj0EAwIDaAAwZQIxAOCrMxHjK4UFKK+oaalbkmf8JbaOTOj9dk2DG7ciGzZ2
+g+sqQq6zyfxoiOCwnGwD6AIwQ4AjIC5LzRUnqVtrbdg4snB3sim8FfhKXW9Rrrhq
+EbUxsAjxGKiCVmTr0UyXFiB9
+-----END CERTIFICATE-----

bindings/rust/bench/certs/ec384/client-cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDGzCCAqCgAwIBAgIUPqC8apGPfAOaZwdkr6H5cPXH9oUwCgYIKoZIzj0EAwIw
+gYkxCzAJBgNVBAYTAkpQMQ4wDAYDVQQIDAVDaGliYTETMBEGA1UEBwwKQ2hpYmEg
+Q2l0eTEYMBYGA1UECgwPVGVzc2llci1Bc2hwb29sMRgwFgYDVQQDDA9kZXZlbG9w
+LmxvY2FsY2ExITAfBgkqhkiG9w0BCQEWEmNhQGRldmVsb3AubG9jYWxjYTAgFw0y
+MzA2MjAxNzQ5MzBaGA8yMjAyMTEyNTE3NDkzMFowYDELMAkGA1UEBhMCVVMxEzAR
+BgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxDzANBgNVBAoMBmNs
+aWVudDEZMBcGA1UEAwwQY2xpZW50LmxvY2FsaG9zdDB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABMX8WCuYv5PV74bCbwe0V+N59uKScDBNBvKsaDfe0Zzw2zKXf1pEhbRi
+oAyxadH88Uw1uozMbif35qUeiJqt07/LMKqFbTSYlUvWAvLRm5wpiv9Py8DWvsji
+0WSJGibcMKOB7jCB6zAUBgNVHREEDTALgglsb2NhbGhvc3QwHQYDVR0OBBYEFE1l
+y7Io0670fI/dz2V6UBEyV/x5MIGzBgNVHSMEgaswgaihgY+kgYwwgYkxCzAJBgNV
+BAYTAkpQMQ4wDAYDVQQIDAVDaGliYTETMBEGA1UEBwwKQ2hpYmEgQ2l0eTEYMBYG
+A1UECgwPVGVzc2llci1Bc2hwb29sMRgwFgYDVQQDDA9kZXZlbG9wLmxvY2FsY2Ex
+ITAfBgkqhkiG9w0BCQEWEmNhQGRldmVsb3AubG9jYWxjYYIUIjXu/mBXiCG4YgAx
+n/hRFLe47IwwCgYIKoZIzj0EAwIDaQAwZgIxAJ5fuUU5B1F5HYnV5KdNIkU0vQMt
+1lk4c+Vh/L9X3nHUrtj5aqQ3yttKNFwS28PxvwIxAPxrzMnGMxYYB4ujMmhj/CZz
+vsg2/wx0vPwPfHSGmaWOPdzX27n2iZyvNlLjGVaEVw==
+-----END CERTIFICATE-----

bindings/rust/bench/certs/ec384/client-key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBRe7cOunVcaEtuUqVO
+frBwYT5ENPaOFHNRSaOK9fmpG/0j5BRRn8JD8CqBo0gHMLuhZANiAATF/FgrmL+T
+1e+Gwm8HtFfjefbiknAwTQbyrGg33tGc8Nsyl39aRIW0YqAMsWnR/PFMNbqMzG4n
+9+alHoiardO/yzCqhW00mJVL1gLy0ZucKYr/T8vA1r7I4tFkiRom3DA=
+-----END PRIVATE KEY-----

bindings/rust/bench/certs/ec384/server-cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDGjCCAqCgAwIBAgIUQ0cVVrzSnGbwpFh/2nAbu7yMsk4wCgYIKoZIzj0EAwIw
+gYkxCzAJBgNVBAYTAkpQMQ4wDAYDVQQIDAVDaGliYTETMBEGA1UEBwwKQ2hpYmEg
+Q2l0eTEYMBYGA1UECgwPVGVzc2llci1Bc2hwb29sMRgwFgYDVQQDDA9kZXZlbG9w
+LmxvY2FsY2ExITAfBgkqhkiG9w0BCQEWEmNhQGRldmVsb3AubG9jYWxjYTAgFw0y
+MzA2MjAxNzQ5MzBaGA8yMjAyMTEyNTE3NDkzMFowYDELMAkGA1UEBhMCVVMxEzAR
+BgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxDzANBgNVBAoMBnNl
+cnZlcjEZMBcGA1UEAwwQc2VydmVyLmxvY2FsaG9zdDB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABJC2pUj/7+bwIS1d2094qztfgCUbFac5dnnDNmiRDFy1pP4SQSrjFo3v
+RJe0eke5VXcOw4i5AuqKkgyr8xZybeb+OoflrHd2VCpf8aCqLLPo5jYg4QAkrgXp
+7AtN7dWlnaOB7jCB6zAUBgNVHREEDTALgglsb2NhbGhvc3QwHQYDVR0OBBYEFDQD
+ydDtN4aSFAvuuWMZU2LKcZufMIGzBgNVHSMEgaswgaihgY+kgYwwgYkxCzAJBgNV
+BAYTAkpQMQ4wDAYDVQQIDAVDaGliYTETMBEGA1UEBwwKQ2hpYmEgQ2l0eTEYMBYG
+A1UECgwPVGVzc2llci1Bc2hwb29sMRgwFgYDVQQDDA9kZXZlbG9wLmxvY2FsY2Ex
+ITAfBgkqhkiG9w0BCQEWEmNhQGRldmVsb3AubG9jYWxjYYIUIjXu/mBXiCG4YgAx
+n/hRFLe47IwwCgYIKoZIzj0EAwIDaAAwZQIwKWZ+rvNGNBzD2aBU+Q3hlkh5rpor
+ZWSYcQ9Q+Wl7CvftZjLC5irD8qpMCQ1TkWCxAjEAhbzz3pJo0I3IGom0rI5napQ5
+TnvosY7sQJl+XAu13kAhRgCZob3Y1wM6HKORGfD2
+-----END CERTIFICATE-----

bindings/rust/bench/certs/ec384/server-key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDB0T4dbewat5Y8DRLsT
+f8YU9fP21tqvZPYLoEBTiHfUelhJptLJ4Y14MQeZUgDhGMuhZANiAASQtqVI/+/m
+8CEtXdtPeKs7X4AlGxWnOXZ5wzZokQxctaT+EkEq4xaN70SXtHpHuVV3DsOIuQLq
+ipIMq/MWcm3m/jqH5ax3dlQqX/Ggqiyz6OY2IOEAJK4F6ewLTe3VpZ0=
+-----END PRIVATE KEY-----

bindings/rust/bench/certs/generate_certs.sh

@@ -6,36 +6,58 @@
 # immediately bail if any command fails
 set -e
 
+# go to directory script is located in
 pushd "$(dirname "$0")"
 
-echo "generating CA private key and certificate"
-openssl req -nodes -new -x509 -keyout ca-key.pem -out ca-cert.pem -days 65536 -config config/ca.cnf
+# Generates certs with given algorithms and bits in $1$2/, ex. ec384/
+# $1: rsa or ec
+# $2: number of bits
+cert-gen () {
+    echo -e "\n----- generating certs for $1$2 -----\n"
 
-# secp384r1 is an arbitrarily chosen curve that is supported by the default
-# security policy in s2n-tls.
-# https://github.com/aws/s2n-tls/blob/main/docs/USAGE-GUIDE.md#chart-security-policy-version-to-supported-curvesgroups
-echo "generating server private key and CSR"
-openssl req  -new -nodes -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -keyout server-key.pem -out server.csr -config config/server.cnf
+    # set openssl argument name
+    if [[ $1 == rsa ]]; then
+        local argname=rsa_keygen_bits:
+    elif [[ $1 == ec ]]; then
+        local argname=ec_paramgen_curve:P-
+    fi
 
-echo "generating client private key and CSR"
-openssl req  -new -nodes -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -keyout client-key.pem -out client.csr -config config/client.cnf
+    # make directory for certs
+    if [ ! -d $1$2/ ]; then
+        mkdir $1$2
+    fi
+    cd $1$2
 
-echo "generating server certificate and signing it"
-openssl x509 -days 65536 -req -in server.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extensions req_ext -extfile config/server.cnf
+    echo "generating CA private key and certificate"
+    openssl req -new -nodes -x509 -newkey $1 -pkeyopt $argname$2 -keyout  ca-key.pem -out ca-cert.pem -days 65536 -config ../config/ca.cnf
 
-echo "generating client certificate and signing it"
-openssl x509 -days 65536 -req -in client.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -extensions req_ext -extfile config/client.cnf
+    echo "generating server private key and CSR"
+    openssl req  -new -nodes -newkey $1 -pkeyopt $argname$2 -keyout server-key.pem -out server.csr -config ../config/server.cnf
 
-echo "verifying generated certificates"
-openssl verify -CAfile ca-cert.pem server-cert.pem
-openssl verify -CAfile ca-cert.pem client-cert.pem
+    echo "generating client private key and CSR"
+    openssl req  -new -nodes -newkey $1 -pkeyopt $argname$2 -keyout client-key.pem -out client.csr -config ../config/client.cnf
 
-cat server-cert.pem ca-cert.pem > server-fullchain.pem
-cat client-cert.pem ca-cert.pem > client-fullchain.pem
+    echo "generating server certificate and signing it"
+    openssl x509 -days 65536 -req -in server.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extensions req_ext -extfile ../config/server.cnf
 
-echo "cleaning up temporary files"
-rm server.csr
-rm client.csr
-rm ca-key.pem
+    echo "generating client certificate and signing it"
+    openssl x509 -days 65536 -req -in client.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -extensions req_ext -extfile ../config/client.cnf
+
+    echo "verifying generated certificates"
+    openssl verify -CAfile ca-cert.pem server-cert.pem
+    openssl verify -CAfile ca-cert.pem client-cert.pem
+
+    echo "cleaning up temporary files"
+    rm server.csr
+    rm client.csr
+    rm ca-key.pem
+
+    cd ..
+}
+
+cert-gen ec 384
+cert-gen rsa 2048
+cert-gen rsa 3072
+cert-gen rsa 4096
 
 popd

bindings/rust/bench/certs/rsa2048/ca-cert.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDnTCCAoUCFBKTl+Yhn/mFVP5L+T6kzqJ2mOvvMA0GCSqGSIb3DQEBCwUAMIGJ
+MQswCQYDVQQGEwJKUDEOMAwGA1UECAwFQ2hpYmExEzARBgNVBAcMCkNoaWJhIENp
+dHkxGDAWBgNVBAoMD1Rlc3NpZXItQXNocG9vbDEYMBYGA1UEAwwPZGV2ZWxvcC5s
+b2NhbGNhMSEwHwYJKoZIhvcNAQkBFhJjYUBkZXZlbG9wLmxvY2FsY2EwIBcNMjMw
+NjIwMTc0OTIzWhgPMjIwMjExMjUxNzQ5MjNaMIGJMQswCQYDVQQGEwJKUDEOMAwG
+A1UECAwFQ2hpYmExEzARBgNVBAcMCkNoaWJhIENpdHkxGDAWBgNVBAoMD1Rlc3Np
+ZXItQXNocG9vbDEYMBYGA1UEAwwPZGV2ZWxvcC5sb2NhbGNhMSEwHwYJKoZIhvcN
+AQkBFhJjYUBkZXZlbG9wLmxvY2FsY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQC7ZntLVOrva3uaLFrGT0iArgRsLJE6aPekPowY0aSF33wpzqSBhwnq
+D1aT8+8/3vGXw187D0DlwQz9tRYFx3Nd2tkrGfgTgQOdDiNHC93LYnb/r74jhrzV
+dB/p/+GgbXmxMtNQq/6fbArrjYwNOegozvcXA5HowP7osvyf+qPFNEuXV/ghD8/2
+1XP/5HnsfAhyf0Ycv7nP5bedRHhrrcnerpsUDIai7ClHPbtB+61zjxjtKDpVSkOD
+VeU6nUdkBxDftRRGNMz/M+5kdb0NHBRjmNPV6GPjS/szRMANqJ1GbkvY9c23avKT
+CIlqkxD5A+I/8209+v6GzULbMSEyy6hfAgMBAAEwDQYJKoZIhvcNAQELBQADggEB
+AI+EcEgB7ohSfQTVQ+ULBrYTRZGxFYxu2AouDooIxximc08G03yrJ6PqfVwjUzLM
+ONkqZfy5rJ/8usobxSC51tUlK9GrIMdsSbyIeYXyRBV9dyQ3dyANhhRwQ/tXUi2B
++5wPCsEnKunTqEJaS8+daLj3Val2lIYLMg+dvoXM60olDWHaVHyHaEcSDJdW6aOp
+hK6pQLm98q+Ypm2i1ZOkNRzqNbl4HagY6QuIWemcmCxGuonTvarLrQQJG3YMzH70
+3bxHIQgS8zuVjFazutmKqEeQftvsTzGbZVOz1OGvSP5F5Vc3iGzIDaUsAxrPLRZ3
+lDIIIgjNfZbK+JdBYCN5O+Q=
+-----END CERTIFICATE-----

bindings/rust/bench/certs/rsa2048/client-cert.pem

@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEaTCCA1GgAwIBAgIUVGiLGecmoRpmr3o3zxu53bCogT4wDQYJKoZIhvcNAQEL
+BQAwgYkxCzAJBgNVBAYTAkpQMQ4wDAYDVQQIDAVDaGliYTETMBEGA1UEBwwKQ2hp
+YmEgQ2l0eTEYMBYGA1UECgwPVGVzc2llci1Bc2hwb29sMRgwFgYDVQQDDA9kZXZl
+bG9wLmxvY2FsY2ExITAfBgkqhkiG9w0BCQEWEmNhQGRldmVsb3AubG9jYWxjYTAg
+Fw0yMzA2MjAxNzQ5MjRaGA8yMjAyMTEyNTE3NDkyNFowYDELMAkGA1UEBhMCVVMx
+EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxDzANBgNVBAoM
+BmNsaWVudDEZMBcGA1UEAwwQY2xpZW50LmxvY2FsaG9zdDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAJT5LBjUvdZ3/DPzlzgRE2bNpwSRIyuuRrTcSpdM
+NtMuwYyFy6cW9BcQax91+g3rCohZpDookNEmJ0iU6GWU/1oP88k4E7JUeSdlwJWX
+oMzO0C1xD6dV+nwEP3PIIvQVTzXPV3ElAL7cUExVwZbegkbtYgwkx6Ki1MhH1uNf
+0/uirxA07UKVjxam9U4A/fPtOxhWfTgbV5G4QcETAN5HfGt53mQm2A/k9I+q8uOW
+uKGBL96QCNo8UQVjISGmZJzpLLmLtqnTeR1+oMyqgEDVeCa1zFmcVPuMmPy/T+IQ
+ALWoGeCKsZPwbwRk5y/KrYNBI72noC2KE0tWDG6pSuVrWnMCAwEAAaOB7jCB6zAU
+BgNVHREEDTALgglsb2NhbGhvc3QwHQYDVR0OBBYEFJbGGREfdolxyVganybAL7MD
+FFNQMIGzBgNVHSMEgaswgaihgY+kgYwwgYkxCzAJBgNVBAYTAkpQMQ4wDAYDVQQI
+DAVDaGliYTETMBEGA1UEBwwKQ2hpYmEgQ2l0eTEYMBYGA1UECgwPVGVzc2llci1B
+c2hwb29sMRgwFgYDVQQDDA9kZXZlbG9wLmxvY2FsY2ExITAfBgkqhkiG9w0BCQEW
+EmNhQGRldmVsb3AubG9jYWxjYYIUEpOX5iGf+YVU/kv5PqTOonaY6+8wDQYJKoZI
+hvcNAQELBQADggEBAKdrTTPRcqybSzF4TX4JyZIKgy9pvM4d+QRjL+mYwefmjB2f
+IWBUVuF6AJx9zHmXEd517nO3KnbuIf3XUpaKJNokEMxrsCC8i639OkP8xrMbn9h6
+Ir7rwKE2u1f5NRuxJWjPhd1U4+DDJWFyxe2pYOJJAj1AVwG3Pn7rP53Gc479eNeG
+dC0QGsOmR2Gsy/kc1R/xhWljaH6Uhw/AWCVzUPT1EnduW4buOS8yxlP6Lu4LR8Do
+HgQJaT9bsGuxwi+YrHL+cKmJFKSadkzaPfIFF6GZRyOiHKh+4dYOaFIUep3lO3ea
+xB5M7jGX3b4EdsLawyfDkpNtumcrrOP0DM3Y8/0=
+-----END CERTIFICATE-----