4 ms·
Cannot be done in suer mode if you have "hardware" implementation inside your NIC. And it is only way to performant TLS.
by blacklion 2y ago
Cannot be done in suer mode if you have "hardware" implementation inside your NIC.
And it is only way to performant TLS.
- toast0 2y agoYou don't really need NIC TLS unless your bitrate is rather high and you're serving data that is stored on disk / in disk cache rather than data that was just generated on the CPU. Bulk ciphering is pretty inexpensive since Intel Haswell (2014) where there was a big improvement in AES-NI, but the load and store around ciphering static content that could otherwise avoid a trip through the CPU can be a significant bottleneck at 100gbps+. I'm sure there are measurable gains from TLS offload in other situations, but it's only critical for static content at high bit rates.