3 ms·
> it took ~0.7% of Google's processing power to encrypt and decrypt RPCs This figure is lower than I thought. Granted, I deal a lot with memcache style workloa
by kccqzy 4y ago
> it took ~0.7% of Google's processing power to encrypt and decrypt RPCs
This figure is lower than I thought. Granted, I deal a lot with memcache style workloads, where each RPC basically just does some hash table lookup/insert and a memcpy of hundreds of kilobytes. I personally see up to 5% of CPU time spent on cryptographic operations (mainly AES-NI instructions). If you aren't Google and can't afford custom silicon to do hardware offload, but you can't drop the encryption-in-transit requirement either, what would you do to improve performance?
- hujun 4y agothere are off-shelf hardware could do IPsec offload, like intel's QAT, or certain types of NICs (like mellanox cx6).
- sanxiyn 4y agoIf you aren't using Linux kernel TLS support already, try it. Obviously it won't help with AES-NI instructions, but it is not rare to see 5% saving by enabling it. https://www.kernel.org/doc/html/latest/networking/tls.html https://www.kernel.org/doc/html/latest/networking/tls.html