cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1581
Views
5
Helpful
3
Replies

Performance impact of using higher DH group for site-to-site VPNs

sludge3000
Beginner
Beginner

Hello all,

 

Just wondering if anyone has or can point me towards any statistics, figures or testing done to show performance impact of using a higher DH group on an ASA for site-to-site VPNs.
Obviously every environment is unique and actual performance may vary etc etc, just wanting to see if anyone knows of anything as I can't find anything online myself.

Or maybe Cisco has some figures they can share?

 

Thanks,

1 Accepted Solution

Accepted Solutions

Bogdan Nita
VIP Alumni
VIP Alumni

I doubt there are such statistics published.

The next generation encryption like DH19, DH20 or DH21 use elliptic curves and offers same level of security with smaller keys and thus with a reduced processing overhead.

Also another way of reducing the performance hit of DH would be to increase the ikev2 lifetime. 

 

HTH

Bogdan

View solution in original post

3 Replies 3

Bogdan Nita
VIP Alumni
VIP Alumni

I doubt there are such statistics published.

The next generation encryption like DH19, DH20 or DH21 use elliptic curves and offers same level of security with smaller keys and thus with a reduced processing overhead.

Also another way of reducing the performance hit of DH would be to increase the ikev2 lifetime. 

 

HTH

Bogdan

Hi Bogdan,

 

I was under the impression that the EC encryption, while using a smaller key size, still uses more processing overhead due to the algorithm used. Just to confirm, that is incorrect and processing overhead is only based on the key length?

Yeah, I've looked for similar performance stats with other vendors before and never get much but though it was worth asking, just in case.

 

Thanks,

Luke

Hi Luke,

I do not think it is a one to one relationship, but that is the idea.

"The main advantage of ECC is that it allows equal security for a smaller key size than the key size used RSA, that is why ECC reduces the processing overhead."

http://ieeexplore.ieee.org/document/8009587/

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: