scp performance

October 13, 2004 @ 9:46 am · Filed under Tech

Friend of mine has link about ssh cipher performance: Re: scp performance degredation [ssh v3.4p1->3.7.1p2].

I decided to do a little testing myself and also investigate the quality of the faster cipher arcfour. On my fastest machine I got the following:


The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
rc4 86255.62k 96272.68k 98883.16k 99605.50k 99732.14k
blowfish cbc 75916.65k 79648.83k 80403.46k 80449.88k 79721.81k
aes-128 cbc 54782.74k 54678.14k 57183.66k 58120.19k 58985.13k
aes-192 cbc 49034.38k 49320.66k 50517.33k 51222.53k 51874.47k
aes-256 cbc 43276.53k 43586.47k 45194.24k 45731.50k 46268.42k

Doing a quick google search on the quality of arcfour I discovered the following reference.


There are a number of other encryption methods (“ciphers”) supported in the ssh distribution, but they are not compiled in unless explicitly requested. These include “Arcfour” (which has a security problem when used with the version 1.5 protocol), “DES” with 56 bit key (which is trivially crackable on modern hardware), and “none” (which is only provided for testing purposes, and introduces multiple security vulnerabilities if enabled).

I did some quick real world tests on my local lan and got these following results:

nic@thunder:~$ scp -c arcfour rails_setup.mov lode:
rails_setup.mov 100% 23MB 7.5MB/s 00:03
nic@thunder:~$ scp -c blowfish rails_setup.mov lode:
rails_setup.mov 100% 23MB 7.5MB/s 00:03
nic@thunder:~$ scp rails_setup.mov lode:
rails_setup.mov 100% 23MB 5.7MB/s 00:04
nic@thunder:~$ scp -c aes256-cbc rails_setup.mov lode:
rails_setup.mov 100% 23MB 4.5MB/s 00:05

Overall it looks like blowfish is a good choice for performance and security. On standard Debian ssh defaults to aes128-cbc. I figure though in most WAN situations you are limited by the size of your pipe, and cipher security is more important.

1 Comment

  1. Richard Said,

    October 13, 2004 @ 11:58 am

    Indeed. It’s quite archtiecture dependant, but Blowfish is a good compromise between performance and speed.

    On Sparc and Power, there’s a HUGE difference between arcfour and bf, but on X86 it’s not so big a deal. Regardless, I’ll take the speed hit for security reasons, but I don’t see a compelling reason to use AES over blowfish.

RSS feed for comments on this post