Ceph » RADOS

per Radoslaw Zarzynski

the overhead between `CreateContextBySym` and `DigestBegin` is small

and probably we can find a light-weighted replacement for NSS, because it's way too expensive to create a PK11Ctx every time when we decrypt or encrypt a buffer.

Summary of the discussion:

`check_message_signature` in `AsyncConnection::process` is being already protected by `AsyncConnection::lock` > `first instance of CephxSessionHandler>check_message_signature_thread_safe()`.

In turn `CephxSessionHandler::sign_message` is called from `AsyncConnection::write_message` where we do `assert(center->in_thread())` > ` second instance of CephxSessionHandler>sign_message_thread_safe()` .

However, PK11 of NSS still can be too costly even after that.

How costly is just the authentication piece, i.e. keep cephx but turn off message signing?

You don't really have authentication without the message signing. Since we don't do full encryption, signing is the only way to prevent man-in-the-middle, and without that detection the value of any kind of cryptography is basically nil.