@CHIP-RTOS - IPsec Throughput Benchmarks
IPC@CHIP® Documentation Index
IP Security Timing Measurements
The encryption/decryption actions taken by IPsec require some significant amount of computer time. The resulting throughput is consequently much lower than normal unencrypted IP communication.The following measurements were made for UDP and TCP packets sent between a 2.2 GHz PC (Intel Core2 Duo CPU T7500) and a SC143 Beck computer, with both computers on the same 100 Mbit/second Ethernet LAN. These measurements can be used as a rough guideline as to what IPsec transfer rates you can expect.
The transport encapsulation mode was used for these IPsec tests.
For comparison, each test section lists a final measurement made with no IPsec applied.
TCP Measurements
These TCP timing tests transfer 10 Mbytes of data over a TCP socket between the PC and Beck target computer to establish the average data transfer rate. Three tests are performed, one for echo (data makes a round trip), one with the Beck target sending 10 Mbytes of data to the PC and a final test with the Beck target receiving 10 Mbytes of data from the PC.The stated results are in units [kByte/second].
Receive Only
| AH | ESP Authentication | ESP Cipher | kByte/Sec |
|---|---|---|---|
| SHA1 | SHA1 | 3DES | 25.5 |
| MD5 | SHA1 | 3DES | 27.4 |
| -- none -- | SHA1 | 3DES | 30.8 |
| SHA1 | SHA1 | DES | 41.1 |
| MD5 | SHA1 | DES | 45.4 |
| -- none -- | SHA1 | DES | 55.1 |
| No IPsec | No IPsec | No IPsec | 1377.9 |
Send Only
| AH | ESP Authentication | ESP Cipher | kByte/Sec |
|---|---|---|---|
| SHA1 | SHA1 | 3DES | 25.6 |
| MD5 | SHA1 | 3DES | 27.4 |
| -- none -- | SHA1 | 3DES | 30.8 |
| SHA1 | SHA1 | DES | 41.1 |
| MD5 | SHA1 | DES | 45.5 |
| -- none -- | SHA1 | DES | 55.6 |
| No IPsec | No IPsec | No IPsec | 968.5 |
Full Echo
| AH | ESP Authentication | ESP Cipher | kByte/Sec |
|---|---|---|---|
| SHA1 | SHA1 | 3DES | 13.0 |
| MD5 | SHA1 | 3DES | 13.9 |
| -- none -- | SHA1 | 3DES | 15.6 |
| SHA1 | SHA1 | DES | 21.0 |
| MD5 | SHA1 | DES | 23.2 |
| -- none -- | SHA1 | DES | 28.4 |
| No IPsec | No IPsec | No IPsec | 661.0 |
UDP Echo Measurements
These UDP timing tests send a datagram containing 1400 bytes from the PC to the Beck target. A UDP server program executing on the Beck target echoes these datagrams back to the PC. This cycle continues for as many datagrams as can be exchanged in a 6 second test period. The resulting average transfer rate (round trip) is stated here in units [kByte/second].| AH | ESP Authentication | ESP Cipher | kByte/Sec |
|---|---|---|---|
| SHA1 | SHA1 | 3DES | 13.5 |
| MD5 | SHA1 | 3DES | 14.4 |
| -- none -- | SHA1 | 3DES | 16.1 |
| SHA1 | SHA1 | DES | 22.1 |
| MD5 | SHA1 | DES | 24.7 |
| -- none -- | SHA1 | DES | 30.2 |
| No IPsec | No IPsec | No IPsec | 922.1 |
Comments
The 3DES cipher method is the slowest available. This cipher and its less secure DES counterpart were the only cipher methods available on the Microsoft PC used for these benchmark tests.When you have a more flexible peer, the cooler running Blowfish cipher is recommended.
Related Topics
- Cipher benchmark tests
End of document