How to choose more efficient SSL in Java

Question

Our application is for load testing arbitrary HTTP(s) servers. We use java with Netty to make lots of concurrent requests. When using the Netty java SSL client and SSLEngine, we are now seeing CPU at 100% for relatively low levels of concurrency. I suspect that the client and server are negotiating the most secure choice available, and I want to do what is likely the opposite (choose the option that will cause the smallest CPU load on our system). We must use SSL, but there is no concern about security. How do we go about configuring the SSLEngine to use a better algorithm?

I realize that the server (which is out of our control) limits the choices. But, we need to use a less CPU intensive option if available. We are running this on Amazon's EC2 with c3.large instances.

don't forget to tell your user's that they using a non secure app — Sleiman Jneidi, Dec 22 '15 at 23:00
The SSL choice here is not for our app, it is for simulating traffic for the purpose of testing. Our app uses appropriate and secure SSL. — Roger Campbell, Dec 22 '15 at 23:11
What exactly is the point of testing and measuring a codniguration hat will never be used? — user207421, Dec 22 '15 at 23:21
Note that TLS Perfect Forward Secrecy will be a little slower because of the DH key negotiation. — zaph, Dec 23 '15 at 02:17

Magnus · Answer 1 · 2021-01-15T02:04:06.987

0

There isn’t necessarily a direct relationship between the security of a particular SSL/TLS cipher suite and its performance. Cipher suites that use elliptic curve cryptography and AES encryption will likely be the fastest. Elliptic curve suites are faster than RSA, and AES has wide hardware CPU acceleration support, AES-128 should be faster than AES-256.

As far as how to choose the cipher suite, take a look at How to specify the ciphersuite to be used in SSL session

Although be wary this is probably going to cause more problems than its worth for minimal performance gain.

edited Jan 15 '21 at 02:04

answered Dec 23 '15 at 00:15

Magnus

7,952
2
26
52

1

Note: On current iPhones I see no difference between AES 128 and 256 bit keys, note that there is hardware encryption support. – zaph Dec 23 '15 at 02:43

How to choose more efficient SSL in Java

1 Answers1