5 ms·

TLS is used for other protocols, e.g., SMTPS (SMTP + TLS). But there's an extra DNS query for this case, and I don't think TLS setup time is a significant cause

TLS is used for other protocols, e.g., SMTPS (SMTP + TLS). But there's an extra DNS query for this case, and I don't think TLS setup time is a significant cause of delays. So I don't know how useful this is.

j16sdiz 4y ago
I think most SMTP use STARTTLS with preetablished TCP connection..
- mananaysiempre 4y ago
  Not sure about real-world statistics, but the current IETF position is that SMTP STARTTLS for mail submission (not transport) is to be phased out in favour of “implicit” SMTP-over-TLS with no cleartext portion, due in part to the former being an implementation minefield[1]. [1] https://datatracker.ietf.org/doc/html/rfc8314#appendix-A https://datatracker.ietf.org/doc/html/rfc8314#appendix-A
  - fomine3 4y ago
    Recent submission https://news.ycombinator.com/item?id=34736416 https://news.ycombinator.com/item?id=34736416
- dwheeler 4y ago
  There's a big push to use implicit TLS with SMTP, instead of STARTTLS. Here's a post about that: https://blog.apnic.net/2021/11/18/vulnerabilities-show-why-starttls-should-be-avoided-if-possible/ https://blog.apnic.net/2021/11/18/vulnerabilities-show-why-s...
aseipp 4y ago
The latency hit of the extra trip will definitely be felt by end users if the endpoint is far enough away (e.g. ~100-200ms.) You can mitigate the initial setup other ways though, like the CDN approach: terminate TLS much closer with a proxy and use a warm, pre-established backhaul connection to the origin. Less round trips are always good, though, without any extra stuff to put in place.
sam0x17 4y ago
Having debugged stuff for someone crazy who wanted less than 50ms global latency for a private search engine I can tell you the TLS negotiation adds significant time the first time you initialize the connection
- 8n4vidtmkvmk 4y ago
  50ms is impossible. Lowerbound is 68. One-way.
  - sam0x17 4y ago
    emphasis on wanted. And it was quite obtainable depending on geo location. Some locations 70 was best we could do, but most of the US east coast we were able to get around 40
- Karrot_Kream 4y ago
  I've designed my own private CDN and unless you have edges near each geo, you're not getting that kind of latency. And even after TLS negotiation you have no idea what the MSS on a link along the way will be causing fragmentation and retransmits. I've made do with some shenanigans with Noise and pre shared certs and have tried to make payload sizes as small as possible.
  - sam0x17 4y ago
    Yes this was using a presence in every GCP and Cloudflare and AWS edge location simultainiously all hooked together with latency based routing
    - Karrot_Kream 4y ago
      Hah gotcha. Hope you got paid well for that. I do it for my own pleasure, but it's a lot of work to do as the internet just isn't designed for low latency interconnect.

j16sdiz 4y ago

I think most SMTP use STARTTLS with preetablished TCP connection..

mananaysiempre 4y ago
Not sure about real-world statistics, but the current IETF position is that SMTP STARTTLS for mail submission (not transport) is to be phased out in favour of “implicit” SMTP-over-TLS with no cleartext portion, due in part to the former being an implementation minefield[1]. [1] https://datatracker.ietf.org/doc/html/rfc8314#appendix-A https://datatracker.ietf.org/doc/html/rfc8314#appendix-A
- fomine3 4y ago
  Recent submission https://news.ycombinator.com/item?id=34736416 https://news.ycombinator.com/item?id=34736416
dwheeler 4y ago
There's a big push to use implicit TLS with SMTP, instead of STARTTLS. Here's a post about that: https://blog.apnic.net/2021/11/18/vulnerabilities-show-why-starttls-should-be-avoided-if-possible/ https://blog.apnic.net/2021/11/18/vulnerabilities-show-why-s...

aseipp 4y ago

The latency hit of the extra trip will definitely be felt by end users if the endpoint is far enough away (e.g. ~100-200ms.) You can mitigate the initial setup other ways though, like the CDN approach: terminate TLS much closer with a proxy and use a warm, pre-established backhaul connection to the origin. Less round trips are always good, though, without any extra stuff to put in place.

sam0x17 4y ago

Having debugged stuff for someone crazy who wanted less than 50ms global latency for a private search engine I can tell you the TLS negotiation adds significant time the first time you initialize the connection

8n4vidtmkvmk 4y ago
50ms is impossible. Lowerbound is 68. One-way.
- sam0x17 4y ago
  emphasis on wanted. And it was quite obtainable depending on geo location. Some locations 70 was best we could do, but most of the US east coast we were able to get around 40
Karrot_Kream 4y ago
I've designed my own private CDN and unless you have edges near each geo, you're not getting that kind of latency. And even after TLS negotiation you have no idea what the MSS on a link along the way will be causing fragmentation and retransmits. I've made do with some shenanigans with Noise and pre shared certs and have tried to make payload sizes as small as possible.
- sam0x17 4y ago
  Yes this was using a presence in every GCP and Cloudflare and AWS edge location simultainiously all hooked together with latency based routing
  - Karrot_Kream 4y ago
    Hah gotcha. Hope you got paid well for that. I do it for my own pleasure, but it's a lot of work to do as the internet just isn't designed for low latency interconnect.