RE: [Isms] TLS / SSH scalability concerns

Hi,

With regard to SIP using DTLS, folks may want to read
<draft-jennings-sip-dtls-00.txt> (February 2005).

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: imcdonald@sharplabs.com

> -----Original Message-----
> From: isms-bounces@lists.ietf.org 
> [mailto:isms-bounces@lists.ietf.org]On
> Behalf Of Eliot Lear
> Sent: Friday, May 13, 2005 12:39 PM
> To: Blumenthal, Uri
> Cc: isms@ietf.org
> Subject: Re: [Isms] TLS / SSH scalability concerns
> 
> 
> I think there might be some truth on both sides of this issue.  For 
> instance, maintaining established sessions goes to Juergen's 
> point that 
> you need to keep getting the biggest baddest largest server to manage 
> "All of This".  On the other hand, if you're not taking 
> authentication 
> steps on each packet there's something to be gained, I'm sure.
> 
> I think it's safe to say that people know how to deal with 
> both.  And I 
> actually think a whole lot of people know a whole lot more about TLS. 
> That has certain benefits.  I would imagine the same thing 
> will be able 
> to be said about DTLS, assuming a major app picks it up.  SIP? 
> Something else?
> 
> Eliot
> 
> Blumenthal, Uri wrote:
> >>FYI (in case you not already know):
> >>
> >>http://www.umiacs.umd.edu/docs/Du.ppt
> >>
> >>They concluded that SNMP/TLS was more efficient than USM. 
> > 
> > 
> > And I have a very nice bridge for sale in the vicinity of NYC. :-)
> > 
> > 
> >>Anyway, these results need to be taken w/ a grain of salt as
> >>there are many factors (e.g. # msgs per session) that may
> >>affect the results.
> > 
> > 
> > The facts are:
> >   - SNMP spends extra cycles on ASN.1 security wrapping/unwrapping;
> >   - TLS spends extra cycles on TCP overhead;
> >   - TLS has large session establishment overhead;
> >   - DES/AES and MD5/SHA1 is done by both, and the cost is similar.
> > 
> > Therefore, the more messages are sent within one long session - the
> > greater the chance of amortizing the session establishment 
> cost and come
> > out even (seems rather obvious). As for TLS solution 
> turning out *more*
> > efficient - forgive me for not entirely trusting those 
> results (assuming
> > apples-to-apples comparison, i.e. using SNMPv3 in both cases).
> > 
> > _______________________________________________
> > Isms mailing list
> > Isms@lists.ietf.org
> > https://www1.ietf.org/mailman/listinfo/isms
> > 
> > 
> 
> _______________________________________________
> Isms mailing list
> Isms@lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/isms
> 

_______________________________________________
Isms mailing list
Isms@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms