Subject: numbers for 2535, ds, and ds+opt-in

From: Mark Kosters <[email-masked]>
Date: Thu, 14 Mar 2002 17:05:26 -0500

Hi

After a couple of very painful months dealing with hardware issues, software
bugs, and slow turn arounds on tests, I have some numbers that compare 2535,
ds, and ds+opt-in.

These numbers were used to look at worst-case scenarios doing full zone 
signings with 2 1024 bit RSA keys. I've used 2 keys since:

  1) we may have to support RSA and DSA.
  2) I did some tests with two RSA keys already.

Baseline Machines: 
  IBM 4-way M80 with 500MHZ cpus running AIX with 16GB of RAM
  A prerelease IA64 4-way with 800MHZ cpus running Linux with 16GB of RAM

Baseline Data:
   To decrease the turnaround time, I've ran a partial zone that consisted of
   8,921,477 delegations. The current com zone is approximately 22,000,000+
   delegations.

Baseline Software:
  Olafur's DS hack to bind 9.2.0rc8 for DS.
  9.2.0 for the 2535 and unsigned tests.

Both machines were quiet as I was doing the testing so the results would
not be skewed in anyway. I did not use any accelerator cards in the test.

The things we looked at were:
   zone signing times (just so people see what it is really like)
   zone file size (affects propagation to the remote sites)
   zone loading time  (down time on the machine on reload)
   zone image size (affects machine sizing)
   zone serving performance (once loaded, how much work has to be done)

1) zone signing times 
                               IBM M80            Intel IA64
   2535                        1,275,421 secs     171,816 secs
   DS (with 0 delegations)       695,232 secs      93,661 secs      

What this shows is that an IBM M80 is not too swift doing RSA sigs :^).
There are a number of crypto accelerator cards out there that would increase 
performance. Some claim to do 3K 1024 bit RSA sigs a second that will speed 
this up. Signing is stuff that can be improved on but I wanted to give some
numbers anyhow.

2) zone file size (affects propagation)
   unsigned                      904 MB 
   2535                       10,932 MB
   DS (0 delegations signed)   5,955 MB

3) zone loading time
                               IBM M80            Intel IA64
   unsigned                     1,767 secs          855 secs
   2535                        28,531 secs        7,109 secs
   DS (0 delegations signed)    8,563 secs        3,934 secs

4) zone image size 
                               IBM M80            Intel IA64
   unsigned                     1.9 GB            1.7 GB
   2535                        10.1 GB            8.8 GB
   DS (0 delegations signed)    6.1 GB            5.5 GB

5) serving performance

   This affect cpu performance on busy machines on lookup for a non-existant
   domain. A non-trivial number of queries turn out to non-existant domains.
   With 2535 and DS, the NXT need to be found and returned after searching
   a tree the size of the delegation space. On opt-in, the search
   tree is the size of the number of secured delegations.

    2535 or DS:
     log2n where n = number of delegations
    Opt-in
     log2m where m = number of secured delegations and where m << n

Now on to the forecasting.

As # of delegations grow in DS, it approaches the signing, filesize, load time,
and image size of 2535. Actually, the secured delegation will be a bit bigger 
than 2535 since the DS RR will be 20 bytes larger than the NULL key RR.

So, with that in mind, here are some #'s between opt-in with ds and ds only
using IA64 numbers on a zone with 8,921K delegations.

00%  Delegations Secured    Image Size    File Size
      opt-in                1.7GB            904 MB
      ds only               5.5GB          5,955 MB
25%  Delegations Secured
      opt-in                3.5GB          3,587 MB
      ds only               6.5GB          7,375 MB
50%  Delegations Secured
      opt-in                5.3GB          6,269 MB
      ds only               7.5GB          8,795 MB
75%  Delegations Secured
      opt-in                7.0GB          8,952 MB
      ds only               8.4GB         10,215 MB
100% Delegations Secured
      opt-in                8.9GB         11,634 MB
      ds only               8.9GB         11,634 MB

As the number of domains grows, opt-in has a steeper curve since it starts
out with a much smaller memory base than ds but grows faster given it
adds the NXT that DS has as part of the base. 

It looks to me that if the percentage of delegations that "opt" to use DNSSEC
stay small, opt-in is a reasonable enhancement.

Thanks,
Mark

-- 

Mark Kosters             [email-masked]       Verisign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>