Performance impact of using higher DH group for site-to-site VPNs

[sludge3000]

Hello all,

Just wondering if anyone has or can point me towards any statistics, figures or testing done to show performance impact of using a higher DH group on an ASA for site-to-site VPNs.
Obviously every environment is unique and actual performance may vary etc etc, just wanting to see if anyone knows of anything as I can't find anything online myself.

Or maybe Cisco has some figures they can share?

Thanks,

[Bogdan Nita · Accepted solution]

I doubt there are such statistics published.

The next generation encryption like DH19, DH20 or DH21 use elliptic curves and offers same level of security with smaller keys and thus with a reduced processing overhead.

Also another way of reducing the performance hit of DH would be to increase the ikev2 lifetime. 

HTH

Bogdan

[sludge3000]

Hi Bogdan,

I was under the impression that the EC encryption, while using a smaller key size, still uses more processing overhead due to the algorithm used. Just to confirm, that is incorrect and processing overhead is only based on the key length?

Yeah, I've looked for similar performance stats with other vendors before and never get much but though it was worth asking, just in case.

Thanks,

Luke

[Bogdan Nita]

Hi Luke,

I do not think it is a one to one relationship, but that is the idea.

"The main advantage of ECC is that it allows equal security for a smaller key size than the key size used RSA, that is why ECC reduces the processing overhead."

http://ieeexplore.ieee.org/document/8009587/