Subject: [TLS] CPU Cost for TLS vs. DTLS

From: Erwin Himawan <[email-masked]>
Date: Tue, 21 Feb 2012 10:37:40 -0600

Hi Folks,

I have been googling for more information on the CPU cost comparison/study
on use of TLS vs. DTLS.
Among other things to consider, this information will also be useful for
determining which transport protocol to use (TCP or UDP).

I am expecting that DTLS will consume less CPU since DTLS does not have the
TCP handshake.
However, how much better?
I am interested to get some idea whether the CPU cost for DTLS and TLS
is significantly less, about the same, or significantly higher.

Does anybody know any paper/study associated with this topic?

Thanks,
Erwin

---

From: Yoav Nir <[email-masked]>
Date: Tue, 21 Feb 2012 21:20:57 +0200

Hi Erwin

Usually TLS and DTLS are not alternatives to each other. If the underlying application is TCP-based (like HTTP), TLS is appropriate, whereas if the application protocol is UDP-based, DTLS is the obvious choice.

The functions for encryption and MAC used by TLS and DTLS are the same, so I wouldn't expect a huge performance difference. Still, because TCP is stream-based, partitioning the data into 16KB records is feasible, so you get less of the per-record cost. With UDP you would try to have your datagrams (and hence your records) fit on IP packets, limiting you to smaller records. I would guess that this advantage would dominate the disadvantage of having to do a three-way handshake.

TCP has another advantage, that dropped packets get retransmitted by TCP, so they don't have to be encrypted again. UDP is not reliable, so retransmissions (if needed) would have to be handled by the application, and DTLS would have to be applied again.

I don't know of any study that proves it, so this is mostly guesswork.

There is one case where DTLS and TLS are alternatives. The so-called "SSL VPN clients" tunnel actual IP packets either through a TCP stream or one-by-one using DTLS. In that case the performance of DTLS is usually much better, but mostly because it avoids the overhead of capturing the packets, placing them on the stream and then separating the incoming stream into packets and reinjecting them into the stack. 

Hope this helps

Yoav

On Feb 21, 2012, at 6:37 PM, Erwin Himawan wrote:

> Hi Folks,
> 
> I have been googling for more information on the CPU cost comparison/study on use of TLS vs. DTLS.
> Among other things to consider, this information will also be useful for determining which transport protocol to use (TCP or UDP).
> 
> I am expecting that DTLS will consume less CPU since DTLS does not have the TCP handshake.
> I am interested to get some idea whether the CPU cost for DTLS and TLS is significantly less, about the same, or significantly higher.
>

---

From: Peter Gutmann <[email-masked]>
Date: Wed, 22 Feb 2012 13:20:38 +1300

>I am expecting that DTLS will consume less CPU since DTLS does not have the

Counterargument: Significant parts of the TCP handshake will be handled by
TOE's in NICs, while for DTLS you have to hand-assemble the reliable transport
that TCP normally gives you.  So DTLS could be a lot more expensive than TLS.

You'd have to run multiple tests, DTLS against TLS with and without various 
levels of TOE (or find some representative NIC that's widely used, probably 
under Windows which the last time I looked has better TOE support than Linux), 
and also under adverse traffic conditions where the DTLS has to work to clean 
up the UDP unreliable transport.

Peter.

---

From: Martin Rex <[email-masked]>
Date: Wed, 22 Feb 2012 01:50:51 +0100 (MET)

> that TCP normally gives you.  So DTLS could be a lot more expensive than TLS.

Even if it's not TOE (Tcp/ip Offload Engine) in NICs, a lot of the
stuff is done in the networking protocol stack of the Kernel,
whereas a reliable transport built by the application in userland
will incur many additonal user<->kernel transitions and eventing.

Unless your traffic patterns are seriously affected by the "TCP slow start"
and "delayed Ack" features in TCP, I would expect TLS-over-TCP
to provide better performance than DTLS-over-UDP.  Where it isn't,
I expect it to be a shortcoming of at least one the particular
implementations in that comparison TLS-over-TCP vs DTLS-over-UDP.

-Martin

---

From: Yoav Nir <[email-masked]>
Date: Wed, 22 Feb 2012 18:01:21 +0200

I think we can all agree that the choice of TLS vs DTLS is not a factor in the decision of whether to base your application on UDP or TCP.

The nature of the application should dictate a reliable, stream-based transport, or a non-reliable datagram-based transport. The differences in performance of TLS vs DTLS are negligible compared to the cost of emulating one transport using the other.

Yoav