Re: [hybi] Upgrade Mechanism and HasMat (was Re: Extensibility mechanisms?)

[Dave Cridland <[e-mail]>]

On Thu Jul 22 13:33:17 2010, Willy Tarreau wrote:
> Hi Dave,
> 
> On Thu, Jul 22, 2010 at 01:27:25PM +0100, Dave Cridland wrote:
> > On Thu Jul 22 13:13:17 2010, Willy Tarreau wrote:
> > >The only fear I have right now with the nonce as defined by the  
> WS
> > >draft
> > >is that it makes use of MD5 which comes with a cost. I know at
> > >least one
> > >site dealing with more than 300k concurrent connections at a rate
> > >between
> > >12 and 18k per second (long polling right now), and I think that
> > >computing
> > >MD5 hashes can significantly impact performance at these rates.  
> If
> > >the
> > >goal is to ensure the response header depends on the request
> > >header, we
> > >may reliably make use of cheaper algorithms.
> >
> > I'd assume that an actual server can do faster than my cheap
> > workstation:
> >
> > $ openssl speed md5
> > Doing md5 for 3s on 16 size blocks: 7765276 md5's in 3.00s
> > Doing md5 for 3s on 64 size blocks: 6086328 md5's in 3.00s
> > Doing md5 for 3s on 256 size blocks: 3674140 md5's in 3.00s
> > Doing md5 for 3s on 1024 size blocks: 1420165 md5's in 3.00s
> > Doing md5 for 3s on 8192 size blocks: 212112 md5's in 3.00s
> >
> > FWIW, SHA-1 is only slightly slower. If you had 300k all join at
> > once, then it still seems to be this would be a drop in the ocean  
> in
> > terms of loading.
> 
> Nice, thanks for feeding some useful info here ! So we can assume
> that a correctly sized server will be able to compute at least 2
> million hashes a second, which translates into less than 1% CPU
> overhead at 20000 connections per second.
> 
> 
Well, perhaps a bit worse than that - say 1 million per second, and  
therefore 2%.

Although MD5 has some security weaknesses, its major problem is  
usually that it's too fast - consider how fast it is to exhaustively  
search the unsalted intermediate hash of Digest authentication, for  
instance.

Dave.
-- 
Dave Cridland - mailto:[e-mail] - xmpp:[e-mail]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade