MIME-Version: 1.0
References: <20230212140148.4F0D.409509F4@e16-tech.com> <PH0PR14MB5493A75DC8E617230D426F09AADD9@PH0PR14MB5493.namprd14.prod.outlook.com>
 <CAN-5tyH45zKa+xcvwMoUzWPewUkwNZpJycNN+ZdHeea8Uj6tFQ@mail.gmail.com>
In-Reply-To: <CAN-5tyH45zKa+xcvwMoUzWPewUkwNZpJycNN+ZdHeea8Uj6tFQ@mail.gmail.com>
From:   Olga Kornievskaia <aglo@umich.edu>
Date:   Tue, 14 Feb 2023 09:53:04 -0500
Message-ID: <CAN-5tyGa6hpJcBkPDocuVPbPEP32Jg5AgR=Z6DbMc7kg_oKsLg@mail.gmail.com>
Subject: Re: question about the performance impact of sec=krb5
To:     Charles Hedrick <hedrick@rutgers.edu>
Cc:     Wang Yugui <wangyugui@e16-tech.com>,
        "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, Feb 13, 2023 at 1:53 PM Olga Kornievskaia <aglo@umich.edu> wrote:
>
> On Mon, Feb 13, 2023 at 1:02 PM Charles Hedrick <hedrick@rutgers.edu> wro=
te:
> >
> > those numbers seem implausible.
> >
> > I just tried my standard quick NFS test on the same file system with se=
c=3Dsys and sec=3Dkrb5. It untar's a file with 80,000 files in it, of a siz=
e typical for our users.
> >
> > krb5: 1:38
> > sys: 1:29
> >
> > I did the test only once. Since the server is in use, it should really =
be tried multiple times.
> >
> > krb5i and krb5p have to work on all the contents. I haven't looked at t=
he protocol details, but krb5 with no suffix should only have to work on he=
aders. 3.2 msec increase in latency would be a disaster, which we would cer=
tainly have noticed. (Almost all of our NFS activity uses krb5.)
> >
> > It is particularly implausible that latency would increase by 3.2 msec =
for krb5, 0.6 msec for krb5i and 1.6 for krb5p. krb5 encrypts only security=
 info. krb5p encrypts everything.  Perhaps they mean 0.32 msec? We'd even n=
otice that, but at least it would be consistent with krb5i and krb5p.
>
> Actually they really did mean 3.2. Here's another reference that
> produces similar numbers :
> https://www.netapp.com/media/19384-tr-4616.pdf . Why krb5 perf gets
> higher latency then the rest is bizarre and should have been looked at
> before publication.

Nevermind. After some investigation, it turns out the public report
has a typo, it should have been 0.2ms. Hopefully they'll fix it.

> > From: Wang Yugui <wangyugui@e16-tech.com>
> > Sent: Sunday, February 12, 2023 1:01 AM
> > To: linux-nfs@vger.kernel.org <linux-nfs@vger.kernel.org>
> > Subject: question about the performance impact of sec=3Dkrb5
> >
> > Hi,
> >
> > question about the performance of sec=3Dkrb5.
> >
> > https://learn.microsoft.com/en-us/azure/azure-netapp-files/performance-=
impact-kerberos
> > Performance impact of krb5:
> >         Average IOPS decreased by 53%
> >         Average throughput decreased by 53%
> >         Average latency increased by 3.2 ms
> >
> > and then in 'man 5 nfs'
> > sec=3Dkrb5  provides cryptographic proof of a user's identity in each R=
PC request.
> >
> > Is there a option of better performance to check krb5 only when mount.n=
fs4,
> > not when file acess?
> >
> > Best Regards
> > Wang Yugui (wangyugui@e16-tech.com)
> > 2023/02/12
> >