[166619] in North American Network Operators' Group
Re: latest Snowden docs show NSA intercepts all Google and Yahoo
daemon@ATHENA.MIT.EDU (George Herbert)
Fri Nov 1 18:36:35 2013
In-Reply-To: <20131101222626.GO3108@burnout.tpb.net>
Date: Fri, 1 Nov 2013 15:36:25 -0700
From: George Herbert <george.herbert@gmail.com>
To: NANOG <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Fri, Nov 1, 2013 at 3:26 PM, Niels Bakker <niels=nanog@bakker.net> wrote:
> * mikal@stillhq.com (Michael Still) [Fri 01 Nov 2013, 05:27 CET]:
>
> Its about the CPU cost of the crypto. I was once told the number of CPUs
>> required to do SSL on web search (which I have now forgotten) and it was a
>> bigger number than you'd expect -- certainly hundreds.
>>
>
> False: https://www.imperialviolet.**org/2010/06/25/overclocking-**ssl.html<https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html>
>
> "On our production frontend machines, SSL/TLS accounts for less than 1% of
> the CPU load, less than 10KB of memory per connection and less than 2% of
> network overhead. Many people believe that SSL takes a lot of CPU time and
> we hope the above numbers (public for the first time) will help to dispel
> that."
That was *front end* SSL/TLS - not internal / back end SSL/TLS.
One could assert that the per-activity SSL/TLS overhead might be the same
for internal services accessed to answer a front-end request, but that's
not necessarily true. The code/request ratios and external/internal
SSL/TLS startup costs are going to vary wildly from service to service.
--
-george william herbert
george.herbert@gmail.com
