3 ms·
this is a big deal for a lot of people. I was always under the impression (I'm pretty sure I had someone at GCP tell me at one point too) that basically all net
by jdc0589 9y ago
this is a big deal for a lot of people. I was always under the impression (I'm pretty sure I had someone at GCP tell me at one point too) that basically all network communication was encrypted behind the scenes, even within your infrastructure. This is clearly not correct.
I asked questions about this exact same thing during a deep dive on EKS at reInvent a couple weeks ago; unsurprisingly the same issue exists there.
- boulos 9y agoRight. Encryption in transit within a building at line rate (and more importantly low latency) is hard. To my knowledge, none of the providers do this currently, otherwise they'd be talking about it. This is us saying it's time to talk about it :). Disclosure: I work on Google Cloud.
- londons_explore 9y agoMilitary stuff uses "XOR the data with a secret keystream", which is zero latency (okay - more like 10 nanoseconds of latency), and can run arbitrarily fast. The only disadvantage is one has to use a stream cipher, and those have fallen out of favor lately...
- mehrdadn 9y agoIs generating a cryptographically secure secret stream that fast?
- namibj 9y agoIf you want to, sure.
- londons_explore 9y agoYou can do it fully in parallel. Imagine 1000 crypto units each producing 100 Mbps of key-stream. All on one ASIC. Then all you need is to interleave the stream and XOR with the data to encrypt your 100Gbps stream.
- wmf 9y agoThe latency isn't from the cipher; it's from touching the data an additional time. A NIC with inline encryption adds negligible latency but Google probably doesn't have those.
- dward 9y agoIf anyone were to have those, it would be google.
- wmf 9y agoSince they design their own NIC, Google certainly has the capability to include whatever features they want. Yet Andromeda appears to be implemented in software.
- theptip 9y agoThe problem is that Google (and all other large cloud providers) use an SDN, and so you can't just encrypt traffic at the NIC level -- you need to just encrypt the encapsulated overlay traffic, while leaving the underlay unencrypted (so that intermediate nodes can route the overlay network traffic). There are a number of technologies that support this kind of thing at the kernel level, but 1) layering these onto an existing SDN is not trivial, and 2) the extra encoding/decoding will absolutely have a performance impact if you're trying to do it at line rate on a 10Gb NIC, e.g. see https://www.weave.works/blog/weave-net-performance-fast-datapath/ https://www.weave.works/blog/weave-net-performance-fast-data....