This has been covered a few times on StackOverflow. https://stackoverflow.com/questions/548029/how-much-overhead-does-ssl-impose https://stackoverflow.com/questions/149274/http-vs-https-performance
Basically, the expensive part is creating the connection (handshaking). After that, when using the connection the overhead should be minimal. Given this I'd suggest the obvious starting point for investigating is to confirm it's not recreating the connection over-and-over.
Because it's a database connection it's unlikely there's a slow-down due to a lack of caching.
Cheers, Jonathan On 18/06/2019 13:28, Bo Victor Thomsen wrote:
Has anyone tried to ascertain how big the overhead is when using SSL - and why ?Regards Bo Victor Thomsen AestasGIS Denamrk Den 18-06-2019 kl. 14:15 skrev Stefan Steiger:Uh, ah, yea, also, sending a password for a DB-user over the intranet-network in plain text is rather bad. While the data retrieved from the DB might not be confidential, maybe there is confidential data in the db. Also, the login used could have permissions onto another DB that has confidential data inside.In my opinion, the default should be SSL, including in intranet.If anybody changes the default for performance reasons, they can, and correspondingly, the blame will be theirs if anything happens.Nowadays, we use SSL even in development. Just my 0.05 $ -----Ursprüngliche Nachricht-----Von: QGIS-Developer [mailto:[email protected]] Im Auftrag von Bernhard StröblGesendet: Montag, 17. Juni 2019 15:31 An: [email protected] Betreff: Re: [QGIS-Developer] SSL Performance Overhead Hi all,I have to add that we use SSL to encrypt the user credentials as we use LDAP to authentificate users at the database. So SSL is not only relevant looking at data stored in the database.Bernhard Am 17.06.2019 um 13:56 schrieb Andreas Neumann:Hi Stefan, Yes, sure. If I were a bank or the national bank I would also mandate use of SSL. Also, when personal data is involved. But many gov authorities have primarily publically available geoinformation (object data, no personal data) in their DBs and no sensitive data. We are just discussing the defaults, anyone can enable SSL if it is useful or required in their usage scenario. Andreas On 2019-06-17 13:20, Stefan Steiger wrote:One of our customers (Swiss National Bank) mandates the use of SSL in their internal LAN, even for DB connections.Using anything but SSL is an insecure mode of communication, even in LAN.RSA/DSA Accepted key-length is 2048 bit, recommended is 3072, ECC is 160 Bit, recommended 256. -Only latest version of OpenSSL allowed -Accepted TLS 1.1+, recommended TLS 1.2+ -SSL Version 3.0 or older are explicitly forbidden -Sha-1 is disallowed, sha2/3 accepted @ hash length 256 Bit -Extended Validation certificates have to be used -Wildcards in fully qualified names not allowed -Accepted: CTR/CBC/CCM/EAX, recommended GCM -SSL accepted with forward secrecy Disabled, recommended Enabled -Recommended CryptRandom: /dev/random, /dev/urandom, as per IT Security Baseline 2017-07-20 *Von:*QGIS-Developer [mailto:[email protected]] *Im Auftrag von *Andreas Neumann *Gesendet:* Montag, 17. Juni 2019 09:05 *An:* Matthias Kuhn <[email protected]> *Cc:* [email protected] *Betreff:* Re: [QGIS-Developer] SSL Performance Overhead Hi, I would say, that the use of SSL should be encouraged if the connection goes through public networks. If the Postgis connection is within the company LAN I don't see a strong reason for enabling SSL, unless the company LAN is designed in an "unsafe" way, or ifsensitive data must be hidden from other employees in the same company.Personally, I never had good results (performance wise) if Postgis connections went through the public Internet, unless it is some "toy data". For this reason, I usually used streaming replication to replicate Postgis, so it is as close as possible to the users who need the data. The streaming replication, if it goes through the public internet, of course should use SSL (or often it goes through an SSH tunnel).Sorry, I don't have any data on the overhead of SSL connections though.Andreas On 2019-06-17 08:48, Matthias Kuhn wrote: Hi,The documentation currently promises "massive speed-ups in PostGISlayer rendering" with SSL disabled. [1 <https://docs.qgis.org/2.18/en/docs/user_manual/managing_data_source/ opening_data.html#creating-a-stored-connection>] I find some references to performance cost of SSL but they should be compensated for with connection pooling which we use for quite some time already. Recently, the web is more and more encrypted - and that is very good! - so I think we should also start to encourage people to encrypt their SSL connections. Or at least certainly not discourage them from using encryption by promising performance benefits.Is there anyone who knows why this sentence was introduced? And ifthere is (still) an issue with performance when using SSL? Best regards Matthias [1] https://docs.qgis.org/2.18/en/docs/user_manual/managing_data_source/opening_data.html#creating-a-stored-connection <https://docs.qgis.org/2.18/en/docs/user_manual/managing_data_source/ opening_data.html#creating-a-stored-connection> [2] https://github.com/qgis/QGIS-Documentation/pull/3840 _______________________________________________ QGIS-Developer mailing list[email protected] <mailto:[email protected]> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developerUnsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer__________ Information from ESET Mail Security, version of virus signature database 19536 (20190617) __________ The message was checked by ESET Mail Security. http://www.eset.com _______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer__________ Information from ESET Mail Security, version of virus signature database 19537 (20190617) __________The message was checked by ESET Mail Security. http://www.eset.com _______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer _______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer_______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
_______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
