Virtual vpn in the cloud

5.2.1
 
Throughput analysis 
In tunnel mode, IPSec VPNs are built and managed across end-to-end gateways. 
As mentioned in the previous sections, tunnel mode protects any internal routing 
information by encrypting the IP header of the entire packet, followed by the 
encapsulation of a new IP header to the original header.
Figure 15: TCP throughput at different MTUs 
The overheads due to encryption lower the network throughput to a great 
extent. Variation in throughout between tunneled and non-tunneled traffic is clearly 
depicted in the graph.
Comparison among different encryption and hashing algorithms are 
evaluated, superior performance is exhibited by AES128-MD5 in terms of throughput. 
The reason being, in comparison to the other hashing algorithm, SHA256, MD5 produces 
128-bit output and SHA256 produces 256-bit output that further brings an additional 
overhead resulting in performance degradation. Also MD5 is considered to be less CPU 
intensive in comparison to SHA family [40]. Though, SHA is considered to be more 
secure, MD5 operates faster and hence its performance. In comparison to the other 
encryption algorithms, 3DES was initially designed for hardware models and hence its 
low efficiency in software implementations, where AES was designed both for software 
and hardware implementations and hence its superior performance. In comparison to 
AES128 and AES256, depending on the cryptographic key length, the longer more is the 
overhead introduces [41].
Few of the drawbacks of 3DES functionality are the usage of weaker and 
shorter keys in comparison to AES, repetitive encryption keys used and the longer time 
duration compared to AES [42]. All these factors enhance the performance efficiency of 
AES128-MD5. Hence AES128-MD5 performs the best, followed by AES256-MD5 and 
AES128-SHA256. 

---

29