3b39edcaa1
Profiles discovered that lookups into the signature cache included an
expensive comparison to the stored `sigInfo` struct. This lookup had the
potential to be more expensive than directly verifying the signature
itself!
In addition, evictions were rather expensive because they involved
reading from /dev/urandom, or equivalent, for each eviction once the
signature cache was full as well as potentially iterating over every
item in the cache in the worst-case.
To remedy this poor performance several changes have been made:
* Change the lookup key to the fixed sized 32-byte signature hash
* Perform a full equality check only if there is a cache hit which
results in a significant speed up for both insertions and existence
checks
* Override entries in the case of a colliding hash on insert Add an
* .IsEqual() method to the Signature and PublicKey types in the
btcec package to facilitate easy equivalence testing
* Allocate the signature cache map with the max number of entries in
order to avoid unnecessary map re-sizes/allocations
* Optimize evictions from the signature cache Delete the first entry
* seen which is safe from manipulation due to
the pre image resistance of the hash function
* Double the default maximum number of entries within the signature
cache due to the reduction in the size of a cache entry
* With this eviction scheme, removals are effectively O(1)
Fixes #575.
102 lines
4 KiB
Go
102 lines
4 KiB
Go
// Copyright (c) 2015 The btcsuite developers
|
|
// Use of this source code is governed by an ISC
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package txscript
|
|
|
|
import (
|
|
"sync"
|
|
|
|
"github.com/btcsuite/btcd/btcec"
|
|
"github.com/btcsuite/btcd/wire"
|
|
)
|
|
|
|
// sigCacheEntry represents an entry in the SigCache. Entries within the
|
|
// SigCache are keyed according to the sigHash of the signature. In the
|
|
// scenario of a cache-hit (according to the sigHash), an additional comparison
|
|
// of the signature, and public key will be executed in order to ensure a complete
|
|
// match. In the occasion that two sigHashes collide, the newer sigHash will
|
|
// simply overwrite the existing entry.
|
|
type sigCacheEntry struct {
|
|
sig *btcec.Signature
|
|
pubKey *btcec.PublicKey
|
|
}
|
|
|
|
// SigCache implements an ECDSA signature verification cache with a randomized
|
|
// entry eviction policy. Only valid signatures will be added to the cache. The
|
|
// benefits of SigCache are two fold. Firstly, usage of SigCache mitigates a DoS
|
|
// attack wherein an attack causes a victim's client to hang due to worst-case
|
|
// behavior triggered while processing attacker crafted invalid transactions. A
|
|
// detailed description of the mitigated DoS attack can be found here:
|
|
// https://bitslog.wordpress.com/2013/01/23/fixed-bitcoin-vulnerability-explanation-why-the-signature-cache-is-a-dos-protection/.
|
|
// Secondly, usage of the SigCache introduces a signature verification
|
|
// optimization which speeds up the validation of transactions within a block,
|
|
// if they've already been seen and verified within the mempool.
|
|
type SigCache struct {
|
|
sync.RWMutex
|
|
validSigs map[wire.ShaHash]sigCacheEntry
|
|
maxEntries uint
|
|
}
|
|
|
|
// NewSigCache creates and initializes a new instance of SigCache. Its sole
|
|
// parameter 'maxEntries' represents the maximum number of entries allowed to
|
|
// exist in the SigCache at any particular moment. Random entries are evicted
|
|
// to make room for new entries that would cause the number of entries in the
|
|
// cache to exceed the max.
|
|
func NewSigCache(maxEntries uint) *SigCache {
|
|
return &SigCache{
|
|
validSigs: make(map[wire.ShaHash]sigCacheEntry, maxEntries),
|
|
maxEntries: maxEntries,
|
|
}
|
|
}
|
|
|
|
// Exists returns true if an existing entry of 'sig' over 'sigHash' for public
|
|
// key 'pubKey' is found within the SigCache. Otherwise, false is returned.
|
|
//
|
|
// NOTE: This function is safe for concurrent access. Readers won't be blocked
|
|
// unless there exists a writer, adding an entry to the SigCache.
|
|
func (s *SigCache) Exists(sigHash wire.ShaHash, sig *btcec.Signature, pubKey *btcec.PublicKey) bool {
|
|
s.RLock()
|
|
defer s.RUnlock()
|
|
|
|
if entry, ok := s.validSigs[sigHash]; ok {
|
|
return entry.pubKey.IsEqual(pubKey) && entry.sig.IsEqual(sig)
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
// Add adds an entry for a signature over 'sigHash' under public key 'pubKey'
|
|
// to the signature cache. In the event that the SigCache is 'full', an
|
|
// existing entry is randomly chosen to be evicted in order to make space for
|
|
// the new entry.
|
|
//
|
|
// NOTE: This function is safe for concurrent access. Writers will block
|
|
// simultaneous readers until function execution has concluded.
|
|
func (s *SigCache) Add(sigHash wire.ShaHash, sig *btcec.Signature, pubKey *btcec.PublicKey) {
|
|
s.Lock()
|
|
defer s.Unlock()
|
|
|
|
if s.maxEntries <= 0 {
|
|
return
|
|
}
|
|
|
|
// If adding this new entry will put us over the max number of allowed
|
|
// entries, then evict an entry.
|
|
if uint(len(s.validSigs)+1) > s.maxEntries {
|
|
// Remove a random entry from the map relaying on the random
|
|
// starting point of Go's map iteration. It's worth noting that
|
|
// the random iteration starting point is not 100% guaranteed
|
|
// by the spec, however most Go compilers support it.
|
|
// Ultimately, the iteration order isn't important here because
|
|
// in order to manipulate which items are evicted, an adversary
|
|
// would need to be able to execute preimage attacks on the
|
|
// hashing function in order to start eviction at a specific
|
|
// entry.
|
|
for sigEntry := range s.validSigs {
|
|
delete(s.validSigs, sigEntry)
|
|
break
|
|
}
|
|
}
|
|
s.validSigs[sigHash] = sigCacheEntry{sig, pubKey}
|
|
}
|