[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: IPsec and TCP

Andrade Software & Networking
Andrad@Netcom.Com
X-Mailer: ELM [version 2.4 PL23]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Length: 1783      

John,

> 
> What's slow about 1 to 2 Mbytes/second?  That's faster than Ethernet,
> and faster by an order of magnitude than almost everyone's connection
> to the Internet (1.5Mbits/sec T1 is the highest common speed).  If 
> you were DES-encrypting main memory accesses, it would be slow; but 
> if you're DES-encrypting an Ethernet, it's plenty fast.

It is slow.  10 Mbit/s Ethernet tops out at around 1.2 Megabytes
per second using TCP/IP (assuming no collisions).  That 1-2 
Megabytes encryption speed means that you are using about 100% 
of a Pentium's 200 Mhz CPU cycles.  Not much room for other 
processing.  On top of that 100 Mbit/s Ethernet is starting to 
become common.  It's will be at least 5 years, assuming Moore's law, 
before the top Intel chips will be fast enough to keep up with it
doing DES.

> 
> Optional hardware assists are quite common on Wintel platforms.  The
> shrinkwrap software simply probes for the hardware (or its driver).
> If it's there, it uses it; if not, it runs slower in software.  This
> gives individual customers the option to buy the hardware if they
> desire more speed.  Just like the original poster said.
> 
DES was designed a long time ago to optimize memory over speed.  This
made a lot of economic sense at the time.  Today it doesn't and we are
now struggling with it trying to retrofit it into modern high-speed
networks.  Saying you can throw hardware at it to speed it up doesn't
make very much economic sense for most of the hosts on the Internet.  
Could you imagine how popular TCP/IP would be today if 15 years ago 
the original designers said that you had to use hardware to get it
to operate fast enough?

- Alex

-- 

Alex Alten
PO Box 11406
Pleasanton, CA  94588
USA

Andrade@Netcom.Com
(510) 417-0159   Fax/Voice
Follow-Ups: