NetScaler

Leverage hardware and software to improve ECDHE cipher performance

September 21, 2020

Contributed by:

S S

Note:

This enhancement is applicable only to the following platforms:

MPX/SDX 11542

MPX/SDX 14000

MPX 22000, MPX 24000, and MPX 25000

MPX/SDX 14000 FIPS (from release 12.0-56.x)

Previously, ECDHE computation on a NetScaler appliance was performed only on the hardware (Cavium chips), which limited the number of SSL sessions at any given time. With this enhancement, some operations are also performed in the software. That is, processing is done both on the Cavium chips and on the CPU cores to improve ECDHE cipher performance.

The processing is first performed in software, up to the configured software crypto threshold. After this threshold is reached, the operations are offloaded to the hardware. Therefore, this hybrid model leverages both hardware and software to improve SSL performance. You can enable the hybrid model by setting the “softwareCryptoThreshold” parameter to suit your requirement. To disable the hybrid model, set this parameter to 0.

Benefits are greatest if the current CPU utilization is not too high, because the CPU threshold is not exclusive to ECDHE computation. For example, if the current workload on the NetScaler appliance consumes 50% of the CPU cycles, and the threshold is set to 80%, ECDHE computation can use an additional 30% of the cycles. After the configured software crypto threshold of 80% is reached, further ECDHE computation is offloaded to the hardware. In that case, actual CPU utilization might exceed 80%, because performing ECDHE computations in hardware consumes some CPU cycles.

Enable the hybrid model by using the CLI

At the command prompt, type:

set ssl parameter -softwareCryptoThreshold <positive_integer>

Synopsis:

softwareCryptoThreshold:

NetScaler CPU utilization threshold (as a percentage) beyond which crypto operations are not done in software. A value of zero implies that CPU is not utilized for doing crypto in software.

Default = 0

Min = 0

Max = 100
<!--NeedCopy-->

Example:

set ssl parameter - softwareCryptoThreshold 80
Done

show ssl parameter
Advanced SSL Parameters

SSL quantum size                  : 8 KB
Max CRL memory size               : 256 MB
Strict CA checks                  : NO
Encryption trigger timeout        : 100 ms
Send Close-Notify                 : YES
Encryption trigger packet c       : 45
Deny SSL Renegotiation            : ALL
Subject/Issuer Name Insertion Format : Unicode
OCSP cache size                   : 10 MB
Push flag                         : 0x0 (Auto)
Strict Host Header check for SNI enabled SSL sessions : NO
PUSH encryption trigger timeout   : 1 ms
Crypto Device Disable Limit       : 0
Global undef action for control policies : CLIENTAUTH
Global undef action for data policies : NOOP
Default profile                   : DISABLED
Disable TLS 1.1/1.2 for SSL_BRIDGE secure monitors    : NO
Disable TLS 1.1/1.2 for dynamic and VPN services : NO
Software Crypto acceleration CPU Threshold : 80
Signature and Hash Algorithms supported by TLS1.2 : ALL
<!--NeedCopy-->

Enable the hybrid model by using the GUI

Navigate to Traffic Management > SSL > Change advanced SSL settings.
Enter a value for Software Crypto Threshold (%).

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

Leverage hardware and software to improve ECDHE cipher performance

September 21, 2020

Contributed by:

S S

September 21, 2020

Contributed by:

S S

Leverage hardware and software to improve ECDHE cipher performance

Enable the hybrid model by using the CLI

Enable the hybrid model by using the GUI

In this article