Accelerate fetching attributes from an object handle #322

keldonin · 2025-11-15T13:49:01Z

Hello team!

this PR is all about optimizing calls when fetching attributes from a (potentially network-based, slow) token. The design goal is to minimize the number of calls to the PKCS#11 layer, using the following strategies:

regroup all attributes within one template instead of making individual calls to C_GetAttributeValue
for those attributes with a known size, pre-allocate buffer
for the others, and only if needed, regroup them in a secondary template, and fetch them all at once
Once done, build up resulting array.

I have tried this patch on a PKCS#11 scanning utility. In some cases, the number of invocations to PKCS#11 APIs is an order of magnitude below the original version, I found it a massive improvement in terms of performance and execution time.

A small benchmarking tool has been added to this PR - the intent is to give the ability to test it against different tokens and see how it goes. It will be removed at a later stage. The former get_attributes() has been temporarily renamed get_attributes_old() to allow for the benchmarking.

Results with SoftHSM

Note: SoftHSM is likely to be a worst-case scenario, as fetching attributes is extremely fast on a software-based token. Playing the benchmarking tool against other equipments (smart cards, HSMs) will yield better results.

Different situations have been tested below:

multiple: several, mixed attributes are requested
single-fixed: a single attribute which size is well known ( e.g. CKA_ENCRYPT)
single-variable: a single attribute with a variable size (e.g. CKA_MODULUS)
single-nonexist: a single attribute that does not exists for the object

The single-variable case is typically on parity ( the stats varies from run to run between 0.95 and 1.05, which range is within standard deviation). All other cases provide better performance.

╔═══════════════════════════════════════════════════════════════════════════════════════════════════╗
║                                  BENCHMARK SUMMARY TABLE                                          ║
╠═══════════════════╦═════════════╦═════════════╦═════════════╦═════════════╦═══════╦═══════════════╣
║     Test Case     ║   Orig Mean ║    Orig p95 ║    Opt Mean ║     Opt p95 ║ Unit  ║    Speedup    ║
╠═══════════════════╬═════════════╬═════════════╬═════════════╬═════════════╬═══════╬═══════════════╣
║ Multiple          ║     1585.61 ║     2867.11 ║      257.49 ║      409.27 ║    µs ║        x 6.16 ║
║ Single-fixed      ║      281.74 ║      800.74 ║      123.31 ║      160.49 ║    µs ║        x 2.28 ║
║ Single-variable   ║      243.94 ║      308.98 ║      245.94 ║      358.56 ║    µs ║        x 0.99 ║
║ Single-nonexist   ║      279.43 ║      762.66 ║      128.42 ║      159.12 ║    µs ║        x 2.18 ║
╚═══════════════════╩═════════════╩═════════════╩═════════════╩═════════════╩═══════╩═══════════════╝

details (generated by Copilot)

Benchmarking and Developer Tooling

Added a new example file benchmark_attributes.rs that benchmarks and compares the performance and correctness of the original (get_attributes_old) and optimized (get_attributes) attribute retrieval implementations. It reports statistics and speedups for various attribute types and scenarios.

Attribute Retrieval Optimization

Implemented a new Session::get_attributes method that optimizes attribute retrieval by pre-allocating buffers for attributes with known fixed sizes and minimizing the number of PKCS#11 calls, while maintaining correctness and filtering out unavailable attributes.
Renamed the old attribute retrieval method to get_attributes_old for benchmarking and comparison purposes.

Utility and Type Improvements

Added the AttributeType::fixed_size method to determine if an attribute type has a known fixed size, supporting buffer pre-allocation and optimization in the new retrieval method.
Minor code improvements such as consistent use of c_void and import adjustments to support the new implementation. [1] [2]

Signed-off-by: Eric Devolder <[email protected]>

…rtcard token when benchmarking Signed-off-by: Eric Devolder <[email protected]>

Copilot

Pull Request Overview

This PR optimizes PKCS#11 attribute retrieval by reducing the number of API calls through intelligent batching and pre-allocation. The optimization pre-allocates buffers for fixed-size attributes and batches variable-size queries to minimize round-trips to potentially slow network-based tokens.

Key changes:

Implemented a new optimized get_attributes() method that uses 1-2 PKCS#11 calls instead of one per attribute
Added AttributeType::fixed_size() to identify attributes with known sizes for pre-allocation
Renamed the original implementation to get_attributes_old() for benchmarking comparison

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
cryptoki/src/object.rs	Adds `AttributeType::fixed_size()` method to identify fixed-size attributes for optimization (contains critical bug with CK_BBOOL size)
cryptoki/src/session/object_management.rs	Implements new optimized `get_attributes()` and renames old version to `get_attributes_old()` for comparison
cryptoki/tests/basic.rs	Adds comprehensive test coverage for the new `get_attributes()` implementation
cryptoki/tests/common/mod.rs	Adds test utility function `get_pretend_library()` to simulate different library behaviors
cryptoki/examples/benchmark_attributes.rs	Adds benchmarking tool to compare performance between old and new implementations

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cryptoki/src/object.rs

cryptoki/examples/benchmark_attributes.rs

cryptoki/tests/common/mod.rs

cryptoki/src/session/object_management.rs

Signed-off-by: Eric Devolder <[email protected]>

Jakuje · 2025-11-20T11:16:44Z

cryptoki/src/session/object_management.rs

+            } else if attr.pValue.is_null() && attr.ulValueLen > 0 {
+                // NULL pointer but has a length - needs fetching in pass2
+                pass2_indices.push(i);


I think this will bail out on the test added in #324 where the softhsm will happily return the variable-length AllowedMechanisms with length 0. Theoretically, this could happen also with other non-fixed size attributes that might be empty, such as CKA_ID (from brief run through the pkcs11 specs).

As I expected, the test from #324 fails with this PR + SoftHSM so it needs some more love:

---- import_export stdout ---- thread 'import_export' (2292734) panicked at cryptoki/tests/basic.rs:1120:26: removal index (is 0) should be < len (is 0)

Jakuje · 2025-11-20T20:39:54Z

Just out of curiosity I ran the benchmark on kryoptic, which is a bit more performance oriented:

╔═══════════════════════════════════════════════════════════════════════════════════════════════════╗
║                                  BENCHMARK SUMMARY TABLE                                          ║
╠═══════════════════╦═════════════╦═════════════╦═════════════╦═════════════╦═══════╦═══════════════╣
║     Test Case     ║   Orig Mean ║    Orig p95 ║    Opt Mean ║     Opt p95 ║ Unit  ║    Speedup    ║
╠═══════════════════╬═════════════╬═════════════╬═════════════╬═════════════╬═══════╬═══════════════╣
║ Multiple          ║       26.75 ║       29.48 ║        9.47 ║        9.53 ║    µs ║        x 2.82 ║
║ Single-fixed      ║        3.99 ║        4.04 ║        1.99 ║        2.02 ║    µs ║        x 2.00 ║
║ Single-variable   ║        4.39 ║        4.45 ║        4.27 ║        4.32 ║    µs ║        x 1.03 ║
║ Single-nonexist   ║        3.36 ║        3.42 ║        1.93 ║        1.97 ║    µs ║        x 1.74 ║
╚═══════════════════╩═════════════╩═════════════╩═════════════╩═════════════╩═══════╩═══════════════╝

The speedup is not that huge, in comparison to softhsm, but obviously noticable:

╔═══════════════════════════════════════════════════════════════════════════════════════════════════╗
║                                  BENCHMARK SUMMARY TABLE                                          ║
╠═══════════════════╦═════════════╦═════════════╦═════════════╦═════════════╦═══════╦═══════════════╣
║     Test Case     ║   Orig Mean ║    Orig p95 ║    Opt Mean ║     Opt p95 ║ Unit  ║    Speedup    ║
╠═══════════════════╬═════════════╬═════════════╬═════════════╬═════════════╬═══════╬═══════════════╣
║ Multiple          ║       36.58 ║       54.87 ║        9.79 ║        9.89 ║    µs ║        x 3.74 ║
║ Single-fixed      ║        5.55 ║        5.67 ║        2.87 ║        3.83 ║    µs ║        x 1.94 ║
║ Single-variable   ║        5.95 ║        6.06 ║        5.84 ║        5.94 ║    µs ║        x 1.02 ║
║ Single-nonexist   ║        4.88 ║        5.00 ║        2.53 ║        2.62 ║    µs ║        x 1.93 ║
╚═══════════════════╩═════════════╩═════════════╩═════════════╩═════════════╩═══════╩═══════════════╝

Jakuje · 2025-11-20T20:50:41Z

cryptoki/src/object.rs

+            AttributeType::StartDate | AttributeType::EndDate => Some(size_of::<CK_DATE>()),
+
+            // CK_VERSION (2 bytes: major + minor)
+            AttributeType::ValidationVersion => Some(size_of::<CK_VERSION>()),


The ValidationCountry says it should be 2 letter ISO country code so lets include it as fixed-length attribute too.

Jakuje · 2025-11-20T21:02:04Z

cryptoki/src/session/object_management.rs

+            } else if attr.pValue.is_null() && attr.ulValueLen > 0 {
+                // NULL pointer but has a length - needs fetching in pass2
+                pass2_indices.push(i);


As I expected, the test from #324 fails with this PR + SoftHSM so it needs some more love:

---- import_export stdout ---- thread 'import_export' (2292734) panicked at cryptoki/tests/basic.rs:1120:26: removal index (is 0) should be < len (is 0)

Jakuje · 2025-11-20T21:06:13Z

cryptoki/src/session/object_management.rs

+        let rv1 = unsafe {
+            Rv::from(get_pkcs11!(self.client(), C_GetAttributeValue)(
+                self.handle(),
+                object.handle(),
+                template1.as_mut_ptr(),
+                template1.len().try_into()?,
+            ))
+        };
+
+        match rv1 {
+            Rv::Ok
+            | Rv::Error(RvError::BufferTooSmall)
+            | Rv::Error(RvError::AttributeSensitive)
+            | Rv::Error(RvError::AttributeTypeInvalid) => {
+                // acceptable - we'll inspect ulValueLen/pValue
+            }
+            _ => {
+                rv1.into_result(Function::GetAttributeValue)?;


The rv1 is not used anywhere after this block so I would rather keep using rv instead of rv1 and rv2 as it makes it easier to read and follow.

keldonin added 2 commits November 15, 2025 09:10

optimized/grouped attributes version of get_attributes

ada1f5c

Signed-off-by: Eric Devolder <[email protected]>

relabelling variables + now using EC instead of RSA + support for sma…

20f79d8

…rtcard token when benchmarking Signed-off-by: Eric Devolder <[email protected]>

Copilot AI review requested due to automatic review settings November 15, 2025 13:49

Copilot started reviewing on behalf of keldonin November 15, 2025 13:49 View session

Copilot finished reviewing on behalf of keldonin November 15, 2025 13:51

keldonin added the enhancement New feature or request label Nov 15, 2025

Copilot AI reviewed Nov 15, 2025

View reviewed changes

Implemented changes suggested by copilot during PR review

2375a05

Signed-off-by: Eric Devolder <[email protected]>

keldonin force-pushed the accelerate_fetching_attributes branch from caa0629 to 2375a05 Compare November 17, 2025 21:53

Jakuje mentioned this pull request Nov 20, 2025

Undefined behavior in CK_ATTRIBUTE::try_from or Session::get_attributes #323

Open

Jakuje reviewed Nov 20, 2025

View reviewed changes

keldonin requested a review from Jakuje November 20, 2025 19:46

Jakuje reviewed Nov 20, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Accelerate fetching attributes from an object handle #322

Accelerate fetching attributes from an object handle #322

Uh oh!

keldonin commented Nov 15, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Jakuje Nov 20, 2025

Uh oh!

Jakuje Nov 20, 2025

Uh oh!

Jakuje commented Nov 20, 2025

Uh oh!

Jakuje Nov 20, 2025

Uh oh!

Jakuje Nov 20, 2025

Uh oh!

Jakuje Nov 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Accelerate fetching attributes from an object handle #322

Are you sure you want to change the base?

Accelerate fetching attributes from an object handle #322

Uh oh!

Conversation

keldonin commented Nov 15, 2025

Results with SoftHSM

details (generated by Copilot)

Benchmarking and Developer Tooling

Attribute Retrieval Optimization

Utility and Type Improvements

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Jakuje Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Jakuje Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Jakuje commented Nov 20, 2025

Uh oh!

Jakuje Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Jakuje Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Jakuje Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants