undefined | Better HN

0 pointscharcircuit1mo ago0 comments

He offloads TLS to the Proxmox server within their home network. TLS is used between that server and Cloudflare to keep everything safe during transport.

0 comments

baobrien1mo ago

Recent OpenBSD should be able to do modern TLS, and probably ACME, which would have been more interesting.

ronjakoi1mo ago

The question is more about the hardware. Back then, TLS existed but was used sparingly for things like banking, because of the computational overhead, at both the server and client end. Today's computers are so much faster that we don't even think about it.

adrian_b1mo ago

AES-GCM would be very slow on such an old computer, without hardware instructions for AES and for CLMUL.

However, this is precisely the reason why TLS also has the option to use ChaCha20-Poly1305, which will have a decent speed even on an ancient SPARC CPU, though on the most recent CPUs it cannot match the throughput of AES-GCM, which is preferred on these.

So if you want to use a SPARC with TLS 1.3, you must configure it to avoid AES-GCM and use only ChaCha20-Poly1305.

j / k navigate · click thread line to collapse