[openssl-users] OpenSSL performance issue

[Prabhat Puroshottam]

I am trying to summarize the problem again, since the previous 
mail seems confusing to some of you. It might help you quickly understand
the problem I am facing:

We have a product, where Client connects to Server (Proxy Server in my 
earlier mail). Client is implemented in C and uses OpenSSL, while Server is 
implemented using Java code with BufferedInputStream and 
BufferedOutputStream. The following are my observations:

1. There is "inordinate" delay during connection establishment.
2. Using ssldump it was found that SSL handshake response from Server is 
    taking most of the time. Rest of the application data transfer and 
    processing hardly takes fraction of a second. The response from SSL 
    handshake by Server comes after anywhere between 2 to 13 seconds 
    after initial response sent by Client.
3. Subsequent analysis of the code showed that it was the first Buffered 
   Read/Write which was taking "inordinate" amount of time.
4. Understanding that first Buffered Read/Write was hung on SSL connection 
    completion, I introduced SSLConnect::startHandshake() so that I can 
    explicitly see where is the problem. It was observed that now 
    startHandshake() blocked for as much time as first Read/Write did. 
    Further none of the Read/Write calls block, and returned data almost 
    immediately.

I would like to understand why startHandshake() is taking so long. I 
understand that it is a asynchronous call, but still the time delay is too much
IMO. Is it something to do with the socket configuration/cipher/encryption 
used? Using ssldump I found there was absolutely no data transfer 
between the sending of client's hello request and subsequent response 
from server, so apparently all the time startHandshake() is busy doing 
something or may be nothing - what I have no idea. FWIW, this is not a 
network latency issue, 1) all the boxes are on the same network, 2) all 
other data transfers combined takes less than 0.4s.

Can somebody kindly suggest what might be wrong or what can be done to 
fix this? Could it be some Socket or SSL setting, encryption/cipher used, or 
something else?


-Prabhat