From: Sean Chittenden <sean@chittenden.org>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-hackers@postgreSQL.org
Cc: pgsql-interfaces@postgreSQL.org
Subject: Re: Speed of SSL connections; cost of renegotiation
Date: Thu, 10 Apr 2003 18:15:57 -0700
Message-ID: <20030411011557.GJ79923@perrin.int.nxad.com> (raw)
In-Reply-To: <7334.1050015002@sss.pgh.pa.us>
References: <7334.1050015002@sss.pgh.pa.us>
> So, questions for the group: where did the decision to renegotiate
> every 64K come from? Do we need it at all? Do we need it at such a
> short interval? And if we do need it, shouldn't the logic be
> symmetric, so that renegotiations are forced during large input
> transfers as well as large output transfers?
It doesn't look like there's any guidance from mod_ssl in Apache 2.0.
http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_kernel.c?rev=1.92&content-typ...
'round line 536 begins a good set of comments, but I think the tail
end of the file has the best commentary:
* Because SSL renegotations can happen at any time (not only after
* SSL_accept()), the best way to log the current connection details is
* right after a finished handshake.
I think the correct solution to this is to have some way of specifying
this via libpq or by some external configuration file as it is
supposed to conform to the client or server's security policy. It'd
say by default that 640K is ok, but that it should be tunable and
apart of the connections properties. Ex:
inline patch 1: libpq-fe.h, libpq-fe.h 2003/04/11 01:12:32 (+3/-0 lines) download inline-1.patchIndex: libpq-fe.h
===================================================================
RCS file: /projects/cvsroot/pgsql-server/src/interfaces/libpq/libpq-fe.h,v
retrieving revision 1.91
diff -u -r1.91 libpq-fe.h
--- libpq-fe.h 2003/03/25 02:44:36 1.91+++ libpq-fe.h 2003/04/11 01:12:32@@ -154,6 +154,9 @@
* Password field - hide value "D" Debug
* option - don't show by default */
int dispsize; /* Field size in characters for dialog */
+#ifdef USE_SSL+ int ssl_reneg_size; /* Rate at which the connection renegotiates keys */+#endif
} PQconninfoOption;
/* ----------------
Someone on IRC suggested that this value be tuned automatically
depending on the cypher used. The more secure the cypher, the less
frequently rekeying is needed. DES = 64K, 3DES = 256K, AES = 512K?
Total WAG on the values there, but it conveys the point. -sc
--
Sean Chittenden
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: sean@chittenden.org, tgl@sss.pgh.pa.us, pgsql-hackers@postgreSQL.org
Subject: Re: Speed of SSL connections; cost of renegotiation
In-Reply-To: <20030411011557.GJ79923@perrin.int.nxad.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox