Subject: RE: [Sip-security] Basic/digest over TLS

From: Ed Ellesson <[email-masked]>
Date: Tue, 23 Oct 2001 18:24:47 -0400

I was under the impression that the max number of file descriptors available
in the OS is the limiting factor in determining the max number of TCP
sessions that are possible.  Does anyone have a list of max possible file
descriptors, or, better yet, max possible active TCP sessions that have been
tested or claimed, on some popular OS's? 

(If someone knows that this limitation has been removed, or if it has been
replaced by perhaps another limitation such as max threads, please advise.)

Thanks, 

Ed Ellesson
LongBoard, Inc.

-----Original Message-----
From: Henning G. Schulzrinne [mailto:[email-masked]]
Sent: Tuesday, October 23, 2001 3:49 PM
To: C. R. Kalmanek
Cc: Jonathan Rosenberg; [email-masked]
Subject: Re: [Sip-security] Basic/digest over TLS

"C. R. Kalmanek" wrote:

> Assuming TLS connections are long-lived, how scalable is this
> solution?  Web servers have not had to deal with persistent
> connections that last essentially forever, from huge numbers
> of clients.  Scalability may not be an issue in the short
> term, but we need to take a longer view.

Would the session lifetimes be much longer than, say, for a web banking
or order application, where it's probably also on the order of minutes
to tens of minutes? 

> 
> Can TLS connections be initiated from server->client? (so we
> don't need to keep them around forever).  If so, what is the
> impact on session establishment delay?

I'm not sure, but according to Thomas, "SSL and TLS Essentials", the
(TCP, I assume) server can ask a client to restart the connection
(Section 4.5.1), using HelloRequest.

Also, this seems to be primarily a memory issue. Anybody know how much
state is consumed by a TLS connection, above and beyond TCP state? If we
assume 1 kB and 20,000 connections, which seems high for a single
server, that's 20 MB, which costs roughly $3.

> 
> IMHO, there is real value to having a UDP based solution that
> is equivalent to TLS in functionality.  IPSec could provide
> this, if combined with an acceptable key management scheme
> (not necessarily IKE) and if server implementations allow
> adequate visibility into the security association that a
> packet arrived on.

In one of my network security exams, I asked students what it would take
to run TLS on top of UDP. We didn't do a careful analysis, but my
perception is that the record layer would have to be modified a bit, but
it wouldn't affect the rest of the protocol. However, I don't think this
is necessary, since the TCP state isn't that big a deal. 

> 
> Any comments on the scalability issue?

See above.

> 
> Not sure we should go home just yet :).
> 
> chuck
> 

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs

_______________________________________________
Sip-security mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/sip-security

_______________________________________________
Sip-security mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/sip-security