SSL Acceleration .info

Hardware: SSL accelerator cards

SSL accelerator cards can be installed into regular commodity server hardware. With the right device drivers and software, the CPU-intensive parts of the SSL transaction will be performed on the card, and not by your web server software.

I actually bought one of these cards. It was as expensive as a whole PC, but it worked great. Unfortunately it is only about twice as fast as a moderately high-end 64-bit Intel or AMD box. Sadly, in a couple of years these PCs will overtake these cards.

Card manufacturers are starting to use some new tricks to get (purportedly) orders of magnitude performance gains over even the fastest 64-bit PCs. This is done by offloading more of the SSL transaction onto the card (i.e. not just the modular exponentiation but the encryption and SSL packet encoding), and sometimes even letting the card do the whole SSL transaction! These cards will then indeed have RJ45 Ethernet jacks to work with network packets directly so that your server is more-or-less free of any SSL load.

A question still remains what kind of performance one will get in a real-life end-to-end system. You see, a manufacturer may claim that a particular microchip can perform 10000 RSA operations per second, but the complete end-to-end solution may have many other overheads; so this figure drops substantially. The care with which the driver software is written can also impact performance dramatically.

Before believing any performance figures for a particular card, find out if a definitive test has been done with real web pages. For example, ask:

Card manufactures are lame to answer this question.

Another question they don't seem to be able to answer is why they keep quoting that long list of supported ciphers on their spec sheets when everyone anywhere just uses RSA+RC4 or RSA+AES. Who is using 4096-bit RSA? (1024-bit is pretty much the standard - even for cia.gov!)

A card may reduce your CPU, but that may not be enough. Buying a card that halves your CPU would be more-or-less the same as deploying a second web server and load-balancing between the two. Also, a card failure is not easy to recover from if you have to wait for a new card to be shipped! On the other hand, commodity server hardware is available just down the street.

Some manufacturers

Cavium http://www.cavium.com/ is a US company that claims to supply Cisco Systems, F5 Networks, Juniper Networks, and Citrix Systems (SSL VPN solutions) with hardware. They make a card called the NITROX based on (I think) their own chipset. This may mean that some router equipment (see TERMINATORS on the right) of these other manufacturers has these cards in them.

Silicom is an Israeli company that makes cards based on the Broadcom chipset: http://silicom.co.il.

eSAITECH is a US company with similar Broadcom based cards: http://www.esaitech.com/

nCipher is a UK company that makes similar cards: http://www.ncipher.com

HP/Compaq seems to have retired their SSL accelerator card products.

IBM has some cards. They don't mention SSL, preferring to use terms like "cryptographic coprocessor" and "e-business": http://www-03.ibm.com/security/cryptocards/ One of their cards claims 2000 SSL per second. This is about the same speed as the card I tested and only twice as fast as an upper-end 64-bit Intel/AMD machine. (Well, let's give them credit for being honest.)

• HOME
• SSL AND MODULAR EXPONENTIATION
• HARDWARE - CARDS
• HARDWARE - ROUTERS/REVERSE PROXIES/TERMINATORS
• FUTURE OF SSL - THE 64-bit FACTOR
• SECURITY CONSIDERATIONS
• HISTORY OF SSL AND SSL DOCS
• TIDBITS
• FEEDBACK AND COMMENTS