MIME-Version: 1.0
References: <20230212140148.4F0D.409509F4@e16-tech.com> <PH0PR14MB5493A75DC8E617230D426F09AADD9@PH0PR14MB5493.namprd14.prod.outlook.com>
In-Reply-To: <PH0PR14MB5493A75DC8E617230D426F09AADD9@PH0PR14MB5493.namprd14.prod.outlook.com>
From:   Olga Kornievskaia <aglo@umich.edu>
Date:   Mon, 13 Feb 2023 13:53:40 -0500
Message-ID: <CAN-5tyH45zKa+xcvwMoUzWPewUkwNZpJycNN+ZdHeea8Uj6tFQ@mail.gmail.com>
Subject: Re: question about the performance impact of sec=krb5
To:     Charles Hedrick <hedrick@rutgers.edu>
Cc:     Wang Yugui <wangyugui@e16-tech.com>,
        "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, Feb 13, 2023 at 1:02 PM Charles Hedrick <hedrick@rutgers.edu> wrote=
:
>
> those numbers seem implausible.
>
> I just tried my standard quick NFS test on the same file system with sec=
=3Dsys and sec=3Dkrb5. It untar's a file with 80,000 files in it, of a size=
 typical for our users.
>
> krb5: 1:38
> sys: 1:29
>
> I did the test only once. Since the server is in use, it should really be=
 tried multiple times.
>
> krb5i and krb5p have to work on all the contents. I haven't looked at the=
 protocol details, but krb5 with no suffix should only have to work on head=
ers. 3.2 msec increase in latency would be a disaster, which we would certa=
inly have noticed. (Almost all of our NFS activity uses krb5.)
>
> It is particularly implausible that latency would increase by 3.2 msec fo=
r krb5, 0.6 msec for krb5i and 1.6 for krb5p. krb5 encrypts only security i=
nfo. krb5p encrypts everything.  Perhaps they mean 0.32 msec? We'd even not=
ice that, but at least it would be consistent with krb5i and krb5p.

Actually they really did mean 3.2. Here's another reference that
produces similar numbers :
https://www.netapp.com/media/19384-tr-4616.pdf . Why krb5 perf gets
higher latency then the rest is bizarre and should have been looked at
before publication.

> From: Wang Yugui <wangyugui@e16-tech.com>
> Sent: Sunday, February 12, 2023 1:01 AM
> To: linux-nfs@vger.kernel.org <linux-nfs@vger.kernel.org>
> Subject: question about the performance impact of sec=3Dkrb5
>
> Hi,
>
> question about the performance of sec=3Dkrb5.
>
> https://learn.microsoft.com/en-us/azure/azure-netapp-files/performance-im=
pact-kerberos
> Performance impact of krb5:
>         Average IOPS decreased by 53%
>         Average throughput decreased by 53%
>         Average latency increased by 3.2 ms
>
> and then in 'man 5 nfs'
> sec=3Dkrb5  provides cryptographic proof of a user's identity in each RPC=
 request.
>
> Is there a option of better performance to check krb5 only when mount.nfs=
4,
> not when file acess?
>
> Best Regards
> Wang Yugui (wangyugui@e16-tech.com)
> 2023/02/12
>