SSL Performance

Posted in 2015

Topics: Performance & Tuning, Security, Permissions & Auditing, Networking & sqlhosts Configuration

EVAN VANDYKE — Fri, 24 Jul 2015 12:37:43 — source: IIUG Forums & Mailing Lists

We are in the process of implementing SSL in transit encryption for IDS 11.7. We are testing on a few servers, and there is an obvious performance drop when using onsocssl. I have tried implementing more VPs to boost performance, but it has a minimal effect. The primary data we need encrypted are image blobs. To give an example of performance drop, an onsoctcp connection serving up 20 images takes 2.682 seconds. The same request, but with onsocssl, takes 15.1 seconds. This is obviously an unacceptable degredation in performance. I'm hoping for any advice on what can be done to boost performance. Has anyone else faced this kind of performance drop when using ssl on IDS?

↪ replying to EVAN VANDYKE

BENJAMIN THOMPSON — Mon, 03 Aug 2015 10:30:40 — source: IIUG Forums & Mailing Lists

Hi, I can't help at the moment but we will be testing this in the next month or two and would be happy to confer then if that's useful for you. I don't know about you but the only reason we need this is because the SQLI protocol sends the db credentials, specifically the password, in the clear. It would a nice enhancement to encrypt the password by default. Ben.

↪ replying to BENJAMIN THOMPSON

Madison Pruet — Mon, 03 Aug 2015 20:38:04 — source: IIUG Forums & Mailing Lists

Why not use the simple password encryption CSM? From: "BENJAMIN THOMPSON" <benjamin.thompson@bskyb.com> To: ids@iiug.org Date: 08/03/2015 03:02 PM Subject: Re: SSL Performance [35553] Sent by: ids-bounces@iiug.org Hi, I can't help at the moment but we will be testing this in the next month or two and would be happy to confer then if that's useful for you. I don't know about you but the only reason we need this is because the SQLI protocol sends the db credentials, specifically the password, in the clear. It would a nice enhancement to encrypt the password by default. Ben. ***************************************************************************= **** Forum Note: Use "Reply" to post a response in the discussion forum.

↪ replying to Madison Pruet

BENJAMIN THOMPSON — Thu, 06 Aug 2015 16:13:08 — source: IIUG Forums & Mailing Lists

Thank you. For some reason I had trouble finding it in the documentation but it is there. Searching for SPWDCSM seems the most direct route.

↪ replying to BENJAMIN THOMPSON

EVAN VANDYKE — Mon, 10 Aug 2015 13:36:46 — source: IIUG Forums & Mailing Lists

Ben, if you are continuing with your testing, it would be very helpful if you shared your findings in regards to performance. I appreciate it.

Glossary

IDS (Informix Dynamic Server)