On 7 March 2015 at 16:13, Rob D <[email protected]> wrote: > Right the SSL handshake is done on the crypto cards, but the mundane SSL > processing for all the packets is done on CPACF. So it's a question of > which you do more, handshakes or long running transactions / conversations. > Most of the IFL burn is in the SSL crypt / de-crypt in my experience, so > that is where the most $$$ lie. >
Let's do the beer coaster analysis. Say you can do symmetric encryption and secure hash, depending on the cipher and digest, at 100 MB/s. For supported ciphers, CPACF can help you out with a factor 5-10. For RSA 2048 bit handshake, you do 50-100 per second with your bare hands. Crypto Express might give you 50-100 times more. When your SSL connections on average transfer 2 MB of data, CPU usage for both is the same. When you have lots of small short connections with little data (eg REST) then SSL handshake becomes significant. When you're copying ISO images over ssh, symmetric encryption is more important and you might need to make sure you have the right cipher. Depending on the workload, your experience might be right. For others it may not. That's exactly why am interested to see real workloads. -Rob > On Mar 6, 2015 11:46 AM, "Rob van der Heij" <[email protected]> > wrote: > > > On 6 March 2015 at 17:23, Rob D <[email protected]> wrote: > > > > Rob what workload are you looking to compare? SSL would make use of the > > > CPACF facility in the Z procs themselves. Crypto cards assist in key > > > exchange and Z\OS type workloads. Zlinux workloads tend to use libs > that > > > don't use crypto card functionality much. > > > > > > > There's many aspects, and some affect performance. For SSL (like your web > > server) there's encryption of the payload (where CPACF may help) but for > > the SSL handshake you have little from CPACF but need Crypto Express to > do > > the sign/verify if you don't want that in software. Your distribution has > > the libica package to exploit the Crypto Express cards. With > openssl-ibmca > > it lets applications exploit it. Similar route for Java based > applications. > > > > Rob > > > > ---------------------------------------------------------------------- > > For LINUX-390 subscribe / signoff / archive access instructions, > > send email to [email protected] with the message: INFO LINUX-390 or > > visit > > http://www.marist.edu/htbin/wlvindex?LINUX-390 > > ---------------------------------------------------------------------- > > For more information on Linux on System z, visit > > http://wiki.linuxvm.org/ > > > > ---------------------------------------------------------------------- > For LINUX-390 subscribe / signoff / archive access instructions, > send email to [email protected] with the message: INFO LINUX-390 or > visit > http://www.marist.edu/htbin/wlvindex?LINUX-390 > ---------------------------------------------------------------------- > For more information on Linux on System z, visit > http://wiki.linuxvm.org/ > ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For more information on Linux on System z, visit http://wiki.linuxvm.org/
