Date: Thu, 10 Apr 2003 20:22:42 -0700
From: Sean Chittenden <sean@chittenden.org>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-hackers@postgreSQL.org, pgsql-interfaces@postgreSQL.org
Subject: Re: Speed of SSL connections; cost of renegotiation
Message-ID: <20030411032242.GL79923@perrin.int.nxad.com>
References: <7334.1050015002@sss.pgh.pa.us>
	<20030411011557.GJ79923@perrin.int.nxad.com>
	<8486.1050028983@sss.pgh.pa.us>
	<20030411025825.GK79923@perrin.int.nxad.com>
	<8640.1050030353@sss.pgh.pa.us>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <8640.1050030353@sss.pgh.pa.us>
User-Agent: Mutt/1.4i

> >> From sshd(8):
> 
> >      -k key_gen_time
> >              Specifies how often the ephemeral protocol version 1 server key
> >              is regenerated (default 3600 seconds, or one hour).
> 
> Hmmm.  But a server key isn't the same as a session key, is it?  Is this
> an argument for renegotiating session keys at all?

The server and client can kick off a key renegotiation.  Generally
it's left up to the client from what I can tell.  The key specified
above is the public key used before the session is encrypted so that
makes sense to rekey... once encrypted though, I don't think it's
necessary to rekey that often.  10MB would likely be a nice and
conservative level that should be outside of the scope of most
PostgreSQL transactions.  -sc

-- 
Sean Chittenden