wolfSSL’s random number generator, called the DRBG, produces the random values behind every key and secure connection. Until now, if several parts of a program (threads) shared one generator at the same time, they could interfere with each other and were not documented as ‘thread safe’. Copying a running program, which Linux calls a “fork”, carried a similar risk.
What changed:
- Sharing is safe by default. The generator now locks itself automatically, so only one thread uses it at a time. Developers no longer have to remember to add that protection themselves.
- Fork protection. When a program copies itself, the copy no longer continues the same random sequence as the original.
- Opt-outs for experts. Teams that already handle this in their own code can turn it off with –disable-rng-autolock and –disable-rng-autofork.
- Kernel builds are unchanged. Both features are off in the Linux kernel module, which handles thread safety differently. See our other blog posts for kernel improvements this release cycle!
Does it slow anything down? Not noticeably. Our team went to great lengths to test and benchmark both raw usage and TLS connection speeds to ensure throughput performance was not negatively impacted! All measurements before and after the thread and fork safety features fell within the +/- 3% tolerance range attributable to ‘noise’ on a non-idle system. Secure-connection (TLS) speed showed no measurable change. Each call costs a few billionths of a second more, which only shows up on very small request samples, not large samples.
Bottom line: wolfSSL now offers a thread safe WC_RNG structure for all your threading needs!
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now