Bug ID 447424: SSL session resumption can mistakenly use software path

Last Modified: Apr 10, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP LTM(all modules)

Known Affected Versions:
10.2.4, 11.0.0, 11.1.0, 11.2.0, 11.2.1, 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.1 HF1, 11.5.1 HF10, 11.5.1 HF11, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.2, 11.5.2 HF1, 11.5.3, 11.5.3 HF1, 11.5.3 HF2, 11.5.4, 11.5.4 HF1, 11.5.4 HF2, 11.5.4 HF3, 11.5.4 HF4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9

Fixed In:
11.5.0 HF1, 11.4.1 HF6, 11.2.1 HF16, 10.2.4 HF8

Opened: Feb 05, 2014
Severity: 3-Major
Related AskF5 Article:
K17022

Symptoms

Resumed SSL server-side sessions can be routed to the software encryption path because the key-size structure is not properly initialized. This causes a performance degradation when encryption hardware is available.

Impact

Slower rate and more CPU usage due to SSL session being encrypted/decrypted in software when it is a valid hardware cipher.

Conditions

Server SSL profile and SSL resumption in play for a connection using a cipher that is allowed to be encrypted in hardware.

Workaround

None

Fix Information

Resumed SSL server-side sessions are now correctly using hardware encryption when it is applicable, instead of always defaulting to software.

Behavior Change