Secure Socket Layers RSA Performance

Secure web communication is possible through the utilization of the Secure Sockets Layer (SSL). Using "openssl speed rsa" we can measure the number of RSA public keys (sign) operations that a system can perform per second using OpenSSL 0.9.8a. Both verifies/s and signs/s benchmarks are rather synthetic, but give an idea of the "pure" encrypting and decrypting speed.

Note that this time we did not compile OpenSSL with specific flags for each architecture (march="xxx") but we used the same flags on each CPU. We feel that this better reflects the real world use of SSL as most people do not know the specific CPU architecture they are running on. So we compiled with the following on all x86 systems:
gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wa,-noexecstack -g -Wall -DMD32_REG_T=int -DMD5_ASM
We also included the T2000 numbers with MAU acceleration via the Solaris Cryptographic Framework from our previous server CPU shootout. One thread of OpenSSL Signing per core is optimal so we tested the quad Xeon MP 7130 with a maximum of 16 threads, as there are 8 physical but 16 logical cores.


Compared to our previous findings, the Opteron 2.4 GHz no longer (slightly) beats the 3 GHz Xeon DP 5160. This is the result of replacing a "compiled specifically for each architecture" binary with a binary that is compiled with the more generic -o3 optimization, which as stated is more realistic. Still, our previous conclusion stands: clock for clock, the Opteron is quite a bit better at this than the Xeon "Core" architecture (Xeon 5160) and a lot better than the Xeon "NetBurst" architecture (Xeon MP 7130). Despite being clocked 20% lower than the Xeon 5160, it is only 9% slower at 4 threads. The 8 MAUs of the Sun T1 still give the 1 GHz Sun the edge when we fire off 32 "SSL RSA Signing" threads.

In the case of doing verifies, the server has to authenticate the identity of the client. This is a lot less intensive, and we show you the verifies/s numbers at 2048 bits. At 1024 bits length, both the Woodcrest and Opteron were able to verify more than 50,000 keys per core, and that is a hard limit of the OpenSSL benchmark.


Again, the Opteron takes the lead. Encrypting or signing will slow down a server much quicker than verifying keys, so this benchmark is of smaller importance than the sign/s benchmark.

SPECjbb2005 MySQL
Comments Locked

88 Comments

View All Comments

Log in

Don't have an account? Sign up now