if you were to recommend a cipher/mode configuration that emphasizes performance for your customers, would you recommend a hardware based accelerated solution over one that isn't? For big data at rest/transit what are some good cipher/mode choices that work well with hardware accelerators?

In particular, I am thinking of the context of loading hadoop clusters in the cloud from on premise. Assuming it's not a managed VPN, would it make more sense to go with ChaCha/Poly or hardware accelerated AES? My thoughts are that the developer loading the cloud will likely have a beefy machine so it should have pretty modern CPUs - therefore I'm thinking of using TLS AES-GCM (I am trying to avoid rolling my own transit security protocol, but this may be necessary).

As this is Big Data, this becomes a significant performance issue when you're talking TB worth of data.

For big data at rest in the cluster, I am thinking definitely hardware accelerated AES, though not sure about the mode of operation. My understanding is that GCM has opcodes in modern CPUs, however, because of the TLS support so that might be a good performant choice.

(Btw, I understand that supporting all modern secure suites is a good idea, but I am looking for strong default configs on both client/server).

  • $\begingroup$ a) Can you deploy arbitrary specialized hardware (rack mounted, PCIe, ..)? b) Do you trust / are you allowed to trust non certified hardware / software with the processing of secret data? C) Is money an issue? $\endgroup$ – SEJPM Apr 25 '16 at 14:01
  • $\begingroup$ a) Yes as long as it isn't too oddball and is a commonly known best practice, b) no, probably not, c) not really $\endgroup$ – Blaze Apr 25 '16 at 14:04
  • $\begingroup$ If you trust the software the answer to your problem becomes AES (GCM?) + as many server CPUs as needed. If you can not trust the software, you need to get hardware you trust (because of certifications?) and let it do the job. These are called HSMs and chances are you'll get them as PCI cards or network connected rack mounted modules and chances are high they'll only support AES (with whatever mode) unless you throw lots of money and time at the vendor. $\endgroup$ – SEJPM Apr 25 '16 at 14:10
  • 1
    $\begingroup$ @SEJPM HSM's are usually focussed on high security applications. They are used by banks and CA's to keep their keys secure. When talking about TLS (as seems to be the case) they it's probably better to refer to the hardware as SSL accelerators. Note that there are certainly also TLS accelerators that turn a TLS connection into a TCP stream (contrary to what the Wikipedia page mentions). $\endgroup$ – Maarten Bodewes Apr 25 '16 at 18:19
  • $\begingroup$ AES-GCM is faster than ChaCha20-Poly1305 IFF all parties have hardware support. Otherwise it is both very slow and subject to cache-timing attacks. Also, if "certified" means FIPS 140-2 then your only option is probably AES-GCM (but note that you SHOULD NOT require FIPS 140-2 complience unless legally required to do so; it gains nothing and actually makes you less secure). $\endgroup$ – Demi Apr 25 '16 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.