Intel 170 Servers, 7xx Servers manual Cryptography Observations, Tips and Recommendations, Cca Csp

Table 8.5

Signing Performance

CCA CSP

Encryption		Threads	RSA Key Length	4764
Algorithm			(Bits)	(Transactions/second)
SHA-1 / RSA	1		1024	794
SHA-1 / RSA	10		1024	1,074
SHA-1 / RSA	1		2048	308
SHA-1 / RSA	10		2048	465
Notes:
y Transaction Length set at 1024 bytes
y See section 8.2 for Test Environment information
Table 8.6
			Financial PINs Performance
			CCA CSP
Threads			Total Repetitions	4764
				(Transactions/second)
1			10000	945
10			100000	966
Notes:

y See section 8.2 for Test Environment information

8.5 Cryptography Observations, Tips and Recommendations

yThe IBM Systems Workload Estimator, described in Chapter 23, reflects the performance of real user applications while averaging the impact of the differences between the various communications protocols. The real world perspective offered by the Workload Estimator may be valuable in some cases

ySSL/TLS client authentication requested by the server is quite expensive in terms of CPU and should be requested only when needed. Client authentication full handshakes use two to three times the CPU resource of server-only authentication. RSA authentication requests can be offloaded to an IBM 4764 Cryptographic Coprocessor.

yWith the use of Collection Services you can count the SSL/TLS handshake operations. This capability allows you to better understand the performance impact of secure communications traffic. Use this tool to count how many full versus cached handshakes per second are being serviced by the server. Start the Collection Services with the default “Standard plus protocol”. When the collection is done you can find the SSL/TLS information in the QAPMJOBMI database file in the fields JBASH (full) and JBFSHA (cached) for server authentications or JBFSHA (full) and JBASHA (cached) for server and client authentications. Accumulate the full handshake numbers for all jobs and you will have a good method to determine the need for a 4764 Cryptographic Coprocessor. Information about Collection Services can be found at the System i Information Center. See section 8.6 for additional information.

•Symmetric key encryption and signing performance improves significantly when multithreaded.

IBM i 6.1 Performance Capabilities Reference - January/April/October 2008
© Copyright IBM Corp. 2008	Chapter 8 Cryptography Performance	147