# Performance with Enabling encryption on Shield

**URL:** <https://discuss.elastic.co/t/performance-with-enabling-encryption-on-shield/75352>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [February 16, 2017, 2:55pm UTC](https://discuss.elastic.co/t/performance-with-enabling-encryption-on-shield/75352 "2017-02-16T14:55:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sss/32/31486_2.png) [@sss](https://discuss.elastic.co/u/sss)\
**Post date:** [February 16, 2017, 2:55pm UTC](https://discuss.elastic.co/t/performance-with-enabling-encryption-on-shield/75352/1 "2017-02-16T14:55:45Z")

</div>

Hi,  
i am interested to know the performance hit caused on enabling encryption with shield.  
I wanted to fine tune few parameters before taking performance numbers.

Any suggestions on configurations of security protocols for better performance. I have some questions in particular

1. How does Shield does encryption at the backend ? JDK SSL or OPEN SSL ?
2. Which cipher suites should be used for better performance ?
3. Is the performance dependent on java version or JCE or other stuff ?
4. are there any benchmarks ES has on enabling encryption

Thanks

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [February 16, 2017, 3:58pm UTC](https://discuss.elastic.co/t/performance-with-enabling-encryption-on-shield/75352/2 "2017-02-16T15:58:13Z")

</div>

> [@sss](#):
>
> 1. How does Shield does encryption at the backend ? JDK SSL or OPEN SSL ?

Shield only uses the JDK SSLEngine.

> [@sss](#):
>
> 1. Which cipher suites should be used for better performance ?

I think you should consider security of the ciphers and prioritize that over performance. For example RC4 ciphers might be faster but it is widely considered insecure.

> [@sss](#):
>
> 1. Is the performance dependent on java version or JCE or other stuff ?

Performance of SSL will be dependent on Java version and the JCE provider. Some providers delegate to native libraries like NSS and this will often yield better performance.

> [@sss](#):
>
> 1. are there any benchmarks ES has on enabling encryption

We do not provide benchmarks as these will depend greatly on your JDK and hardware. The [Rally tool](https://github.com/elastic/rally) can be used to test performance against a cluster running elasticsearch with shield/xpack security.

> [@sss](#):
>
> I wanted to fine tune few parameters before taking performance numbers.

I think you are better off taking baseline numbers before changing any parameters; you may wind up with a slower configuration than the default if you do not.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2017, 3:58pm UTC](https://discuss.elastic.co/t/performance-with-enabling-encryption-on-shield/75352/3 "2017-03-16T15:58:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.