[OpenAFS] fs setcrypt benchmarks?

[Ray Link]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 3 Jun 2003, Jim Rees wrote:

> Using fcrypt adds a great deal of security.  It's one of the best things you
> can do.

I agree that encrypting the traffic across the network is an excellent
thing to do, and will definitely do so if the processing overhead is
minimal enough to warrant it.  However, I can't go pissing off the
users if fcrypt slows down access to their files by, for example, an
order of magnitude.

> Without fcrypt, any passive snooper can read your files.  With it, today, a
<snip>
> Gilmore hasn't built an fcrypt cracker yet.  And if he did, he wouldn't
> spend a week of computer time to get a few hours of your, or my, afs
> traffic.  He'd crack your password instead.

There are other things to be gained from snooping AFS traffic.  Private SSH
and PGP/GnuPG keys come to mind.  One's private SSH keyring might grant
access to more systems than a single AFS password would, thereby becoming a
juicier target.

Unfortunately, here are no absolutes in computer security.  Any
additional security is a good thing, provided it is both
computationally free and does not hinder users.  Since there is no such
thing as an encryption algorithm that takes less clock cycles than a
NOOP, we have to weigh the benefits of encrypting the AFS traffic
across the network against the CPU expense of performing the
encryption.

Don't get me wrong; I'd love to enable fcrypt on all of our systems
right now.  I just have to prove to management that it won't have a
noticeable impact on our users.  That's why I asked for benchmarks.

==== Ray Link === University of Pittsburgh CSSD === rlink@pitt.edu ====
   ==== PGP/GPG Key:  http://www.pitt.edu/~rlink/gpgkey.asc.txt ====

"If you have any trouble sounding condescending,
  find a Unix user to show you how it's done."   --Scott Adams
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (SunOS)
Comment: pgpenvelope 2.10.2 - http://pgpenvelope.sourceforge.net/

iD8DBQE+3PTY45ROaygcYMIRAqjeAJ9U31IYNGd3dBrOPZjahJx6+8J9ZgCfVSLe
UwBAxRmg60WMkAkHEPdu+DY=
=gEOo
-----END PGP SIGNATURE-----