offload the RSA keypair generation? #372

New Issue

warner · 2008-03-28T19:59:24Z

warner commented

2008-03-28 19:59:24 +00:00

We're monitoring the allmydata.com user-facing web-api server, and we're
noticing that it is doing a significant amount of RSA key generation. Each
time somebody creates a directory, the reactor is stalled for a second or two
while the CPU cranks through the generation of the kilobit primes. This will
reduce responsiveness: not just for the dirnode creation taking place, but
for all others users.

We're thinking about pushing the keypair generation off to a separate
process. The interface would be to drop a "key-generation.furl" in your
node's basedir. If present, a simple foolscap protocol would be used to ask
this server for a key. The server could pre-generate a batch of keys when
it's idle. The server would probably run on the same server as the web-api
machine, but it could use a different core if that host is SMP.

We're monitoring the allmydata.com user-facing web-api server, and we're noticing that it is doing a significant amount of RSA key generation. Each time somebody creates a directory, the reactor is stalled for a second or two while the CPU cranks through the generation of the kilobit primes. This will reduce responsiveness: not just for the dirnode creation taking place, but for all others users. We're thinking about pushing the keypair generation off to a separate process. The interface would be to drop a "key-generation.furl" in your node's basedir. If present, a simple foolscap protocol would be used to ask this server for a key. The server could pre-generate a batch of keys when it's idle. The server would probably run on the same server as the web-api machine, but it could use a different core if that host is SMP.