Subject: RE: TLS for peering (was RE: Comments(RE:[speermint]requirementsdraft submitted))

From: "Michael Hammer \(mhammer\)" <[email-masked]>
Date: Tue, 4 Jul 2006 09:46:37 -0400

Rohan,

With your $2000 server, can it support 300,000 simultaneous connections
held for 3 minutes or more, dropping and adding 300 connections per
second?  And what is the percentage CPU and core memory used to do that?

If the TLS would be handled completely on the I/O card, that would be
great.

Mike

> -----Original Message-----
> From: Rohan Mahy [mailto:[email-masked]] 
> Sent: Thursday, June 29, 2006 8:05 PM
> To: Andrew Newton
> Cc: Khan, Sohel Q [CTO]; [email-masked]; Uzelac, Adam
> Subject: Re: TLS for peering (was RE: 
> Comments(RE:[speermint]requirementsdraft submitted))
> 
> Andy,
> 
> What you've described are a bunch of hacks that service 
> providers use because they don't peer over the Internet or 
> because they can't rely on the other guy to support TLS.  The 
> combination of hacks is much, much more expensive in terms of 
> both capital equipment and operationally than just using TLS.
> 
> A $2000 rack mount server can encrypt and decrypt a 
> phenominal volume of TLS traffic.  Hardware crypto 
> accellerators are available that increase this volume and 
> decrease initial TLS handshake latencies by another couple of 
> orders of magnitude.
> 
> I'm willing to bet a few beers that the amount of data that 
> is encrypted using TLS exceeds the total volume of PSTN 
> signaling traffic on a daily basis.
> 
> To those who have a problem with TLS, I ask them to provide 
> some quantitative data or real requirements rather than 
> rhetoric and FUD.
> 
> thanks,
> -rohan
> 
> 
> 
> 
> 
> On 6/28/06, Andrew Newton <[email-masked]> wrote:
> >
> > On Jun 28, 2006, at 2:48 PM, Richard Shockey wrote:
> > > how do you propose to establish a trust relationship between SIP 
> > > domain boundaries without TLS?
> >
> > There are other methods: security lower in the stack, private 
> > connections, address ACLs...  the things that providers use today.
> >
> > > If you cannot establish a trust relationship between 
> interconnecting 
> > > partners then what is the purpose of this whole exercise?
> >
> > To answer the second part of that sentence: I don't know; I've been 
> > asking that question for quite some time.
> >
> > -andy
> >
> > _______________________________________________
> > Speermint mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/speermint
> >
> 
> _______________________________________________
> Speermint mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/speermint
> 

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

---

From: "Rohan Mahy" <[email-masked]>
Date: Tue, 4 Jul 2006 08:42:32 -0700

Hi Michael,

Don't confuse the number of calls or signaling transactions with the
number of TLS connections. You only need as many TLS connections as
other carriers you are willing to peer with.

Lets say I am willing to peer with a community of 10,000 other
carriers.  Of these, lets say that in an average hour I might get or
make a call with 1000 of them and that 100 of these will see more or
less continuous use throughout the day.  The connections to these 100
will be up all the time.  The other 900 that I happen to peer with one
hour will be different from the other 900 that I peer with the next
hour.

Now looking at Eric's performance data, a cheap server should have no
trouble handling the setups for all 900 new connections for the hour
in less than one second.  That seems like a comfortable margin to me.
Hardware accelerators can increase that number 10-fold for less than
$5000.

Even if the number of carriers I am willing to peer with increases
100-fold to 1 million (one carrier for approximately every 7000
people), I can still talk with all of them over the course of a day
very inexpensively.

thanks,
-rohan