W dniu 2013-04-18 16:10, Phil Smith pisze:
Massimo Biancucci wrote:
we've been installing a new application using crypto facility calling services
like 'CSNBKEX' or 'CSNBKIM'.
We've done all the possible (in our understanding) to optimize the application,
so now we can measure more than 150 msg/second per single application server.
What does sound really strange to me is the elapsed time of the two routines
previsouly mentioned.
Every call costs more than one millisecond.
Cause the CEC is a z12 and the crypto is in HW, I believe those elapsed should
have been microseconds.
Anybody got a similar experience ?
It sounds like you think the Crypto Express is for performance. That's a common misconception: CEX is for
*security*. Calling CEX is essentially doing I/O, so it's not cheap, where "not cheap" means
"a couple of orders of magnitude slower than CPACF, and slower even than just software for most
operations". This is why I like to say, "CEX is not always good" (yeah, say it out loud...).
A millisecond for a CEX call doesn't strike me as "long" at all.
Crypto cards are also for performance but under specific conditions.
Think about it as about powerful computer but connected using 100km long
FICONs. CPU speed is OK, throughput is OK, but "travel time" is long.
So, computing-intensive algorithms, big blocks of data - that's
candidates for offload.
On the other hand, for example TN3270 over SSL (after the handshake) is
not worth to send to Crypto cards.
BTW: Cyrpto card in ACCELERATOR mode does not provide any additional
security (no secure key operations), it is solely for SPEED, especially
SSL handshake.
My €0.02
--
Radoslaw Skorupka
Lodz, Poland
--
Tre tej wiadomoci moe zawiera informacje prawnie chronione Banku
przeznaczone wycznie do uytku subowego adresata. Odbiorc moe by jedynie
jej adresat z wyczeniem dostpu osób trzecich. Jeeli nie jeste adresatem
niniejszej wiadomoci lub pracownikiem upowanionym do jej przekazania
adresatowi, informujemy, e jej rozpowszechnianie, kopiowanie, rozprowadzanie
lub inne dziaanie o podobnym charakterze jest prawnie zabronione i moe by
karalne. Jeeli otrzymae t wiadomo omykowo, prosimy niezwocznie
zawiadomi nadawc wysyajc odpowied oraz trwale usun t wiadomo
wczajc w to wszelkie jej kopie wydrukowane lub zapisane na dysku.
This e-mail may contain legally privileged information of the Bank and is intended solely for business use of the addressee. This e-mail may only be received by the addressee and may not be disclosed to any third parties. If you are not the intended addressee of this e-mail or the employee authorised to forward it to the addressee, be advised that any dissemination, copying, distribution or any other similar activity is legally prohibited and may be punishable. If you received this e-mail by mistake please advise the sender immediately by using the reply facility in your e-mail software and delete permanently this e-mail including any copies of it either printed or saved to hard drive.
BRE Bank SA, 00-950 Warszawa, ul. Senatorska 18, tel. +48 (22) 829 00 00, fax
+48 (22) 829 00 33, www.brebank.pl, e-mail: [email protected]
Sd Rejonowy dla m. st. Warszawy XII Wydzia Gospodarczy Krajowego Rejestru Sdowego, nr rejestru przedsibiorców KRS 0000025237, NIP: 526-021-50-88.
Wedug stanu na dzie 01.01.2013 r. kapita zakadowy BRE Banku SA (w caoci wpacony) wynosi 168.555.904 zotych.
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
