Benchmark SSH Ciphers

# Get a list of ciphers supported by the SSH client
ssh -Q cipher | sort -u

# Get a list of ciphers supported by the SSH server running locally
sudo sshd -T | grep ciphers | perl -pe 's/,/\n/g' | sort –u

# Get a list of ciphers supported by a remote SSH server (using nmap)
nmap --script ssh2-enum-algos -sV -p 22 hostname.of.server.to.check

# Get a list of ciphers supported by a remote SSH server (using SSH client)
ssh -vv hostname.of.server.to.check 'exit' 2>&1 | grep 'ciphers stoc' | awk '{print $4}' | tr , '\n' | sort | uniq

In my case the following ciphers are available on both sides:

aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com

Testing File

I will be testing by transferring a 100G file and a 5GB file for each cipher. To create the test file I use truncate:

truncate -s 100G 100G
truncate -s 5G 5G

Benchmarks

Now to run the benchmarks. Each benchmark will transfer the test file to /dev/null. To specify the cipher to use for each benchmark the Ciphers option will be provided. For context, the default cipher that is used without specifying any options is chacha20-poly1305@openssh.com.

# Set list of ciphers to test
CIPHERS=(aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com)

# Test each cipher 3 times with 100GB file
for i in `seq 1 3`; do
    for CIPHER in "${CIPHERS[@]}"; do
        echo "Test ${i} for 100GB file with cipher: ${CIPHER}"
        scp -o Ciphers=$CIPHER 100G localhost:/dev/null
    done
done

# Test each cipher 3 times with 5GB file
for i in `seq 1 3`; do
    for CIPHER in "${CIPHERS[@]}"; do
        echo "Test ${i} for 5GB file with cipher: ${CIPHER}"
        scp -o Ciphers=$CIPHER 5G localhost:/dev/null
    done
done

# Global settings for all hosts
Host *
  Ciphers ^aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,chacha20-poly1305@openssh.com,aes128-ctr