Acra is designed to provide optimal security model out of the box, as well as to provide a number of ways for controlling (and sometimes programmatically reconfiguring) some of the security and performance properties.
--acrastruct_injectedcell_enableCLI parameter) can be used as a means of security through obscurity: you can hide AcraStruct in a large JPEG picture, and store it, thus increasing the complexity of locating the sensitive data.
During the feature freeze of 0.75 and when we were researching insane memory leaks, we did a few performance tests to understand how much performance penalty Acra will impose on the full roundtrip to the app and back. We wrote 10k rows, requested 10k requests:
|without acra||6.263646909 sec||36.397444647 sec|
|without zone, no encrypted records||21.764239688 sec||-|
|without zone, all encrypted records||34.915005008 sec||70.29645783|
|with zone, no encrypted records||22.799269264 sec||-|
|with zone, all encrypted records||37.159501001 sec||74.951257645 sec|
The goal was to never exceed 10x performance penalty (typical for using interpreted languages with random quality libraries and poor concurrency). Writes are 2x slower, reads are 6 times slower max. It is worth mentioning that compiling Themis while changing the underlying cryptography backend to some more robust implementations of crypto primitives can significantly improve Acra performance.
wholecellis much faster than
injectedcellbecause it doesn't require scanning the whole byte stream.
injectedcellmode, you might want to limit the length of your database response - the longer it is, the longer it scans for AcraStruct.