offload the RSA keypair generation?

[warner]

We're monitoring the allmydata.com user-facing web-api server, and we're noticing that it is doing a significant amount of RSA key generation. Each time somebody creates a directory, the reactor is stalled for a second or two while the CPU cranks through the generation of the kilobit primes. This will reduce responsiveness: not just for the dirnode creation taking place, but for all others users.

We're thinking about pushing the keypair generation off to a separate process. The interface would be to drop a "key-generation.furl" in your node's basedir. If present, a simple foolscap protocol would be used to ask this server for a key. The server could pre-generate a batch of keys when it's idle. The server would probably run on the same server as the web-api machine, but it could use a different core if that host is SMP.

[warner]

rob implemented this several weeks ago and it's been working correctly on the prodnet webapi servers.

[zooko]

Milestone 1.0.1 deleted