Re: [TLS] record layer limits of TLS1.3

A) OpenSSL does not measure the actual TLS performance (including nonce construction, additional data, etc),  but rather just the speed of the main encryption loop.

B) Still, I agree with Yoav. From my experience, the difference in TPT between 16K records and 64K records is negligible, as well as the network overhead. On the other hand using larger records increases the risk of HoL blocking.

Cheers,
Vlad

> On Nov 24, 2016, at 6:16 AM, Yoav Nir <ynir.ietf@gmail.com> wrote:
> 
> 
>> On 24 Nov 2016, at 15:47, Hubert Kario <hkario@redhat.com> wrote:
>> 
>> On Wednesday, 23 November 2016 10:50:37 CET Yoav Nir wrote:
>>>> On 23 Nov 2016, at 10:30, Nikos Mavrogiannopoulos <nmav@redhat.com> wrote:
>>>>> On Wed, 2016-11-23 at 10:05 +0200, Yoav Nir wrote:
>>>>> Hi, Nikos
>>>>> 
>>>>> On 23 Nov 2016, at 9:06, Nikos Mavrogiannopoulos <nmav@redhat.com>
>>>> That to my understanding is a way to reduce
>>>> latency in contrast to cpu costs. An increase to packet size targets
>>>> bandwidth rather than latency (speed).
>>> 
>>> Sure, but running ‘openssl speed’ on either aes-128-cbc or hmac or sha256
>>> (there’s no test for AES-GCM or ChaCha-poly) you get smallish differences
>>> in terms of kilobytes per second between 1024-byte buffers and 8192-byte
>>> buffers. And the difference going to be even smaller going to 16KB buffers,
>>> let alone 64KB buffers.
>> 
>> this is not valid comparison. openssl speed doesn't use the hardware
>> accelerated codepath
>> 
>> you need to use `openssl speed -evp aes-128-gcm` to see it (and yes, 
>> aes-gcm and chacha20-poly1305 is supported then)
>> 
>> What I see is nearly a 1GB/s throughput increase between 1024 and 8192 byte blocks for AES-GCM:
>> 
>> type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
>> aes-128-gcm     614979.91k  1388369.31k  2702645.76k  3997320.76k  4932512.79k
>> 
>> While indeed, for chacha20 there's little to no difference at the high end:
>> type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
>> chacha20-poly1305   242518.50k   514356.72k  1035220.57k  1868933.46k  1993609.50k  1997438.98k
>> 
>> (aes-128-gcm performance from openssl-1.0.2j-1.fc24.x86_64, chacha20-poly1305 from openssl master, both on 
>> Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz)
> 
> Cool. So you got a 23% improvement, and I got an 18% improvement for AES-GCM. I still claim (but cannot prove without modifying openssl code (maybe I’ll do that over the weekend) that the jump from 16KB to 64KB will be far, far less pronounced.
> 
> Yoav
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls