I've built a web app which uses the openssl_private_decrypt() functions.

The rendering of a page with 15 messages encrypted with these functions takes remarkely longer as the ones without. (3-4 times)

The application runs on a simple VPS with 1024mb RAM and 2.5ghz (1core).

If I want to speed up the encryption/decryption process; what is the best to upgrade? RAM or CPU? What defines the speed of the encryption processes?

closed as too broad by Lucas Kauffman, TildalWave, Xander, Adi, Iszi Jan 28 '14 at 21:16

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • It's quite normal that encryption functions take up extra CPU and sometimes memory. To be honnest, why don't you just benchmark the whole thing and find out yourself? – Lucas Kauffman Jan 28 '14 at 18:17

If I am to believe the documentation (a bold notion indeed), the openssl_private_decrypt() function does symmetric decryption with RSA, using OpenSSL (the library) for the actual cryptographic work. On your VPS, you can run the following command to benchmark OpenSSL:

openssl speed rsa

This will give you the speed of RSA private and public key operations on your machine. On mine, I get 833.7 private key operations per second for a 2048-bit key; 15 successive calls would hardly be noticeable. However, your VPS might be considerably feebler than my 3.1 GHz E3 Xeon. Also, you might have used an oversized private key (computation time is mostly cubic in the key size). If the benchmark shows that the RSA decryption speed is indeed the problem, then you may do the following:

  1. Use a smaller key. The normal RSA key size is 2048 bits; there is no need to go beyond that (2048 bits are enough for security for, at least, the 30 next years). 1024 bits are no longer recommended, though this is not breakable yet (it can plausibly be done with existing technology, but it will entail building a quite expensive dedicated machine). If you are short on CPU power, you might want to try a middle-ground, e.g. a 1536-bit key. Do NOT go below 1024 bits.

  2. Add a bigger CPU. RAM is not relevant. Having more CPU helps only for parallel processing, i.e. several users accessing the server simultaneously.

  3. Do something else. You do not describe your usage context, but chances are that if you need to do 15 RSA decryption on a single page, then you are doing something wrong. For instance, I surmise that you may have noticed that RSA encryption works only up to a limited size (117 bytes for a 1024-bit RSA key), and that you might have decided to encrypt a longer message by splitting it into 117-byte long blocks and applying RSA on each of them separately. This path leads to suffering. Don't do that. Do hybrid encryption (but if I have to tell you that, then you don't know enough to do anything secure yet).

(Every time I look at what PHP does with crypto it fills me with dread, disgust, and a sense of impending doom. People who can design a function called openssl_public_decrypt() for "decrypting data with the public key" are people who apparently heard before 1993 but did not bother to check whether science had somehow progressed in the last 20 years. Are you sure you want to use such tools for anything which requires actual security ?)

  • Thank you for this elaborate answer. According to the benchmark, my server does 527.5 sign/s (2048) I am using 4096bit keys.... then the sign/s rate goes to 73/s. At the moment I am just encrypting the whole text with the public key, so I can decrypt it with the private key. I considered Hybrid encryption, but somehow it went of the table. I'd better re-introduce it :) What length of key would you advise to symmetric encrypt the text with 2048keys (1024bits=117bytes, 2048=?)? – stUrb Jan 28 '14 at 20:11
  • Back to the drawing board :) – stUrb Jan 28 '14 at 20:11

Improved CPU speeds will technically help, but probably not by as much as you hope or want. Especially nowadays, as most performance gains are made by adding cores to chips, rather than increasing clock cycles.

Operations in asymmetric encryption are typically much, much slower than their counterparts in symmetric encryption. For this reason, asymmetric ciphers are frequently used for the purpose of securely exchanging secret symmetric keys, which can then be used by both sides to encrypt and decrypt data in bulk. You may want to investigate this possibility.

Another option is to run the decryption tasks in parallel. You probably have at least four cores on your server, but a typical PHP page will only use one of them to render it. If those decryptions are completely independent of one-another, they can be run on multiple cores simultaneously, giving you a sizable performance boost for "free".

Not the answer you're looking for? Browse other questions tagged or ask your own question.