Some time ago (6 weeks or so) I did some performance measures (WSS4J has timing logs build in) and we see here that Verification/Signature is real time consuming, followed by public KEy encryption, followed by symmetrical encryption....this ordering comes with no surprise.
Only the real time consumed is quite high. Regards, Werner ----- Original Message ----- From: "Anderson Jonathan" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, February 27, 2004 7:23 PM Subject: RE: Using XML security slows down the Axis Call > We're using Apache's WSS4J, which uses XML-Security under the covers. We're > seeing similar orders of magnitude. > > Also, just FYI - there is an XML-Users mailing list in addition to the > XML-Dev list. I know the XML-Dev guys like to keep the user traffic down. > :) > > -Jon > > -----Original Message----- > From: Erwin van der Koogh [mailto:[EMAIL PROTECTED] > Sent: Friday, February 27, 2004 10:57 AM > To: [EMAIL PROTECTED] > Subject: Re: Using XML security slows down the Axis Call > > > > But I am very much worried about the PERFORMANCE. After > > "org.apache.xml.security.Init.init()" of xml security is called (during > > authentication), calling Call.invoke method takes more time. The > > difference is in the order of multiples of 5. > > Verifying signatures is a very expensive operation.. Back in the days when > we were extremely serious about performance it could take up to a second on > a P100 and that was just the verify.. With XML-DSig there's a whole bunch > of extra parsing and verification to be done, slowing it down even more. Of > course computers are a lot more powerful, but I think they pretty much keep > up :) > > > Have any of you faced this problem? Why > > org.apache.xml.security.Init.init() slows down the Call.invoke() > > Is the performance really Init.init()? Cause that might take a while, but > that should only be one once. Subsequent calls to this method should return > instantly. > > Erwin > >
