Subject: Towards a Scalable Modular QUIC Server

From: "Eggert, Lars" <[email-masked]>
Date: Mon, 21 Aug 2017 19:13:47 +0000

This was just presented at the SIGCOMM KBNets workshop: https://dl.acm.org/citation.cfm?id=3098587

Yufeng Duan, Massimo Gallo, Stefano Traverso, Rafael Laufer, and Paolo Giaccone. 2017. Towards a Scalable Modular QUIC Server. In Proceedings of the Workshop on Kernel-Bypass Networks(KBNets '17). ACM, New York, NY, USA, 19-24. DOI: https://doi.org/10.1145/3098583.3098587

Possibly of interest to some.

Lars

---

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Aug 2017 10:06:50 +1000

Clearly the authors didn't understand why RSA was chosen by Google.

---

From: "Eggert, Lars" <[email-masked]>
Date: Tue, 22 Aug 2017 00:13:36 +0000

> Clearly the authors didn't understand why RSA was chosen by Google.

I asked whether they had thoughts on whether their results might be influenced by QUIC-Crypto and if IETF-QUIC might perform differently...

Lars

---

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Aug 2017 10:21:15 +1000

> I asked whether they had thoughts on whether their results might be influenced by QUIC-Crypto and if IETF-QUIC might perform differently...

ECDSA might produce entirely different results here.  The computation
effort is largely dominated by the cost of the signature.  That is
assuming that they used x25519 for key exchange, which is pretty close
to zero cost in comparison to RSA.

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 22 Aug 2017 16:11:42 -0700

I'm not sure what to make of this paper:

"A single thread in cQUIC based on DPDK achieves 600 and 1000
connections/s for 2-RTT and 0-RTT, respectively.

...

Interestingly, the performance gap between the 2-RTT and 0-RTT
handshakes is around 75%, but cQUIC scarcely overcomes the threshold
of 1000 connections/s for the 0-RTT. "

1. 1000/600 = 1.667, which isn't really 75% (this is a nit).
2. As MT says, you would expect a far larger gap between any handshake
involving RSA and one which does not, so that's surprising. As MT says,
ECDSA should make this is a lot faster.

Without knowing more about their methodology, and about their profiles,
etc., I don't think we can draw that many conclusions from this beyond
what we already know from the standard microbenchmarks.

-Ekr

On Mon, Aug 21, 2017 at 5:21 PM, Martin Thomson <[email-masked]>
wrote:

> > I asked whether they had thoughts on whether their results might be
> influenced by QUIC-Crypto and if IETF-QUIC might perform differently...
>