X-Original-To: pgsql-hackers@postgreSQL.org Received: from spampd.localdomain (postgresql.org [64.49.215.8]) by postgresql.org (Postfix) with ESMTP id 62FC2475AE5; Thu, 10 Apr 2003 23:05:50 -0400 (EDT) Received: from sss.pgh.pa.us (unknown [192.204.191.242]) by postgresql.org (Postfix) with ESMTP id B68F6474E42; Thu, 10 Apr 2003 23:05:49 -0400 (EDT) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.12.9/8.12.9) with ESMTP id h3B35r2L008641; Thu, 10 Apr 2003 23:05:53 -0400 (EDT) To: Sean Chittenden Cc: pgsql-hackers@postgreSQL.org, pgsql-interfaces@postgreSQL.org Subject: Re: Speed of SSL connections; cost of renegotiation In-reply-to: <20030411025825.GK79923@perrin.int.nxad.com> References: <7334.1050015002@sss.pgh.pa.us> <20030411011557.GJ79923@perrin.int.nxad.com> <8486.1050028983@sss.pgh.pa.us> <20030411025825.GK79923@perrin.int.nxad.com> Comments: In-reply-to Sean Chittenden message dated "Thu, 10 Apr 2003 19:58:25 -0700" Date: Thu, 10 Apr 2003 23:05:53 -0400 Message-ID: <8640.1050030353@sss.pgh.pa.us> From: Tom Lane X-Spam-Status: No, hits=-32.3 required=5.0 tests=BAYES_00,EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT, REFERENCES,REPLY_WITH_QUOTES autolearn=ham version=2.50 X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp) X-Archive-Number: 200304/346 X-Sequence-Number: 37836 Sean Chittenden writes: >> From sshd(8): > -k key_gen_time > Specifies how often the ephemeral protocol version 1 server key > is regenerated (default 3600 seconds, or one hour). Hmmm. But a server key isn't the same as a session key, is it? Is this an argument for renegotiating session keys at all? In any case, you can pump a heck of a lot of data through ssh in an hour. Based on that, it sure looks to me like every-64K is a ridiculously small setting. If we were to crank it up to a few meg, the performance issue would go away, and we'd not really need to think about changing to a time-based criterion. regards, tom lane