Right the SSL handshake is done on the crypto cards, but the mundane SSL processing for all the packets is done on CPACF. So it's a question of which you do more, handshakes or long running transactions / conversations. Most of the IFL burn is in the SSL crypt / de-crypt in my experience, so that is where the most $$$ lie. On Mar 6, 2015 11:46 AM, "Rob van der Heij" <[email protected]> wrote:
> On 6 March 2015 at 17:23, Rob D <[email protected]> wrote: > > Rob what workload are you looking to compare? SSL would make use of the > > CPACF facility in the Z procs themselves. Crypto cards assist in key > > exchange and Z\OS type workloads. Zlinux workloads tend to use libs that > > don't use crypto card functionality much. > > > > There's many aspects, and some affect performance. For SSL (like your web > server) there's encryption of the payload (where CPACF may help) but for > the SSL handshake you have little from CPACF but need Crypto Express to do > the sign/verify if you don't want that in software. Your distribution has > the libica package to exploit the Crypto Express cards. With openssl-ibmca > it lets applications exploit it. Similar route for Java based applications. > > Rob > > ---------------------------------------------------------------------- > For LINUX-390 subscribe / signoff / archive access instructions, > send email to [email protected] with the message: INFO LINUX-390 or > visit > http://www.marist.edu/htbin/wlvindex?LINUX-390 > ---------------------------------------------------------------------- > For more information on Linux on System z, visit > http://wiki.linuxvm.org/ > ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For more information on Linux on System z, visit http://wiki.linuxvm.org/
