1

Essentially what the subject says. I was wondering if there are there benefits to be gained performance-wise by using the same encryption/decryption mechanism when clients communicate via messages sent-to/received-from the same nats server.

I have posed the same question here if anyone is interested:

https://github.com/nats-io/nats-server/discussions/2740

Consider for instance the following two scenarios for nats-based communication:

  • Scenario#1:

A publisher (P) is publishing over to nats on subject "foo.bar", using encryption-decryption-scheme (A) with his own encryption-key (A)

A consumer (C) is subscribed to nats-subject "foo.bar", using encryption-decryption-scheme (B) with his own encryption-key (B)

In this scenario I assume that that nats-server will decrypt messages published by (P) using decryption scheme (A) examine the subject and forward "foo.bar" messages over to consumer (C) after having re-encrypted these messages using encryption-scheme (B).

  • Scenario#2:

A publisher (P) is publishing over to nats on subject "foo.bar", using encryption-decryption-scheme (A) with his own encryption-key (A)

A consumer (C) is subscribed to nats-subject "foo.bar", using the exact same encryption-decryption-scheme (A) as the publisher

In this scenario I assume that that nats-server would only need to decrypt just the subject of the message published by (P) using decryption scheme (A) and after examining the subject it would forward "foo.bar" messages over to consumer (C) by "copy-pasting" the payload (data) of the message "as-is" since the encryption-decryption mechanism is the exact same.

I guess this symmetry in encryption-decryption should provide better performance when the load is high.

Am I right in these assumptions? Or do I miss something? I haven't seen anyone pointing out scenario#2 as a means to boost performance and reduce latency (potentially reducing error rates as well).

Thoughts? Insights? Links to relevant documentation?

XDS
  • 3,786
  • 2
  • 36
  • 56
  • 1
    I think you are overestimating the cost of encryption. – Ebbe M. Pedersen Dec 13 '21 at 15:35
  • @EbbeM.Pedersen I could be. But is there a benchmark or something to that effect that proves this is in a definitive manner? It's best to try and verify things properly rather than assuming them. – XDS Dec 13 '21 at 17:28
  • If you save say 50% of crypto operations, you save a factor 2 on crypto operations .. Simply choosing between the different asymmetric algorithms and key sizes will have far bigger impact on the crypto cost. The Openssl standalone command have a speed option that quickly can show you a speed measure of each algorithm. – Ebbe M. Pedersen Dec 15 '21 at 02:02

1 Answers1

0

Got a response from user "Todd Beets" in this thread:

https://github.com/nats-io/nats-server/discussions/2740#discussioncomment-1799935

<< NATS does not do encrypt/decrypt at the NATS Protocol [1] (Layer 7) level as in your assumption.

"On the wire" NATS does fully support TLS with NATS clients [2].

As TLS terminates at a NATS server, in affect, NATS is playing a pattern as in Scenario 1 (i.e. 1..N subscribing NATS Clients have independent TLS connections and keys).

[1] https://docs.nats.io/reference/reference-protocols/nats-protocol#client-protocol

[2] https://docs.nats.io/using-nats/developer/security/tls >>

(emphasis mine)

XDS
  • 3,786
  • 2
  • 36
  • 56