]> Cypherpunks repositories - gostls13.git/commit
crypto/internal/fips140/drbg: avoid global lock on rand state
authorRuss Cox <rsc@golang.org>
Tue, 7 Jan 2025 17:07:07 +0000 (12:07 -0500)
committerRuss Cox <rsc@golang.org>
Wed, 8 Jan 2025 18:28:31 +0000 (10:28 -0800)
commite966a2773cced08d584e0a462c4b30a84e3a46be
tree5b731ad83bc9d614f6f26b6eecd6522d184142a8
parent9a44df66758c65e6f0b3ab0002a297d2fc266d7c
crypto/internal/fips140/drbg: avoid global lock on rand state

Having a global lock on the random state (used only in FIPS-140 mode)
introduces contention in concurrent programs. Use an approximately
per-P random state instead, using sync.Pool to manage per-P state.

This code is important to land for the Go 1.24 release because it is
part of the FIPS-140 module that will be validated and certified,
so it will live for a long time. We otherwise wouldn't be able to
correct this contention for at least a year, perhaps more.

At the same time, the code is only used in the FIPS-140 mode,
so there is no risk to normal programs.

Fixes #71155.

Change-Id: I6b779f15ddfdf232f608f5cda08f75906e58114f
Reviewed-on: https://go-review.googlesource.com/c/go/+/641097
Reviewed-by: Austin Clements <austin@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
src/crypto/internal/fips140/drbg/rand.go
src/crypto/internal/fips140/drbg/rand_test.go [new file with mode: 0644]