{"id":280,"date":"2015-09-13T14:25:03","date_gmt":"2015-09-13T13:25:03","guid":{"rendered":"http:\/\/www.ingby.com\/?p=280"},"modified":"2015-09-13T14:31:54","modified_gmt":"2015-09-13T13:31:54","slug":"effektiv-ssh-med-ratt-algoritm","status":"publish","type":"post","link":"https:\/\/www.ingby.com\/?p=280","title":{"rendered":"Effektiv SSH med r\u00e4tt algoritm"},"content":{"rendered":"

Jag skulle \u00f6verf\u00f6ra stora m\u00e4ngder lokalt lagrade data till en ny Synology DS415+ NAS. F\u00f6r detta anv\u00e4nde jag rsync \u00f6ver ssh. Initialt kom jag upp i ca 70-80 MB\/s. P\u00e5 NASen l\u00e5g CPU-lasten p\u00e5 ca 70%, framf\u00f6rallt SSH. Det fick mig att fundera p\u00e5 om krypteringsalgoritmen har betydelse. <\/p>\n

I korthet s\u00e5 fungerar aes128-gcm@openssh.com<\/em> b\u00e4st f\u00f6r mina \u00f6verf\u00f6ringar till en Synology DS415+.<\/p>\n

B\u00e5de datorn och NAS:en har en CPU som st\u00f6der h\u00e5rdvaruaccelerering (AES-NI).<\/p>\n

\nnas> grep aes \/proc\/cpuinfo
\nflags\t\t: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm sse4_1 sse4_2 movbe popcnt tsc_deadline_timer aes<\/strong> rdrand lahf_lm 3dnowprefetch arat epb dtherm tpr_shadow vnmi flexpriority ept vpid tsc_adjust smep erms\n<\/p><\/blockquote>\n

Genom att k\u00f6ra <\/p>\n

ssh -v<\/strong> nas<\/p><\/blockquote>\n

kunde jag se att aes128-ctr anv\u00e4nds:<\/p>\n

debug1: kex: server->client aes128-ctr<\/strong> hmac-sha1-etm@openssh.com none\n<\/p><\/blockquote>\n

L\u00e4ge att j\u00e4mf\u00f6ra den r\u00e5a prestandan f\u00f6r de olika algoritmerna:<\/p>\n

\nopenssl speed -elapsed -evp aes-128-ctr
\nopenssl speed -elapsed -evp aes-128-gcm\n<\/p><\/blockquote>\n

NAS<\/p>\n

\ntype 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
\naes-128-ctr 150684.16k 334513.56k 486158.76k 553676.46k 581135<\/strong>.02k
\naes-128-gcm 108917.29k 219577.81k 291686.91k 319687.00k 328081<\/strong>.41k\n<\/p><\/blockquote>\n

Lokalt<\/p>\n

\ntype 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
\naes-128-ctr 590559.55k 1648565.89k 2948549.21k 3609877.85k 3<\/strong>992999<\/strong>.25k
\naes-128-gcm 367441.70k 927592.85k 1221258.41k 1328180.22k 1<\/strong>336317<\/strong>.27k\n<\/p><\/blockquote>\n

(The ’numbers’ are in 1000s of bytes per second processed.)<\/p>\n

Provade \u00e4ven att sl\u00e5 av AES-NI och kan d\u00e5 se betydligt s\u00e4mre prestanda:<\/p>\n

OPENSSL_ia32cap=”~0x200000200000000″ openssl speed -elapsed -evp aes-128-ctr
\ntype 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
\naes-128-ctr 134160.20k 145078.31k 551143.34k 608067.93k 637536<\/strong>.94k\n<\/p><\/blockquote>\n

Teoretiskt borde CTR vara snabbare \u00e4n GCM. Men teori och praktik \u00e4r olika saker. <\/p>\n

\u00d6verf\u00f6ring med aes128-ctr<\/p>\n

\n$ dd if=\/dev\/zero bs=1M count=20000 conv=sync | ssh -c aes128-ctr<\/strong> -o Compression=no nas ”cat – >\/dev\/null”;
\n20000+0 records in
\n20000+0 records out
\n20971520000 bytes (21 GB) copied, 238,251 s, 88,0 MB\/s<\/strong>\n<\/p><\/blockquote>\n

Top p\u00e5 NAS:en<\/p>\n

\n PID PPID USER STAT VSZ %MEM %CPU COMMAND
\n27797 27778 root R 56960 2.7 70.2 sshd: dsadmin@notty\n<\/p><\/blockquote>\n

\u00d6verf\u00f6ring med aes128-gcm@openssh.com<\/p>\n

\n$ dd if=\/dev\/zero bs=1M count=20000 conv=sync | ssh -c aes128-gcm@openssh.com<\/strong> -o Compression=no nas ”cat – >\/dev\/null”;
\n20000+0 records in
\n20000+0 records out
\n20971520000 bytes (21 GB) copied, 185,63 s, 113 MB\/s<\/strong>\n<\/p><\/blockquote>\n

Top p\u00e5 NAS:en<\/p>\n

\n PID PPID USER STAT VSZ %MEM %CPU COMMAND
\n29162 29143 root S 23272 1.1 19.0 sshd: dsadmin@notty\n<\/p><\/blockquote>\n

Prestanda som motsvarar den f\u00f6rv\u00e4ntade med tanke p\u00e5 gr\u00e4nsen f\u00f6r Gigabit-ethernet. CPU-belastningen \u00e4r betydligt b\u00e4ttre.<\/p>\n

N\u00e4r jag k\u00f6r SSH-testet ovan mot localhost p\u00e5 den station\u00e4ra s\u00e5 f\u00e5r jag prestanda som \u00f6vertr\u00e4ffar Gigabit-ethernet. I detta fall g\u00f6rs b\u00e5de kryptering och dekryptering p\u00e5 samma maskin, vilket naturligtvis drar ner resultatet.<\/p>\n

\nc@localhost:~$ dd if=\/dev\/zero bs=1M count=20000 conv=sync | time ssh -c aes128-ctr<\/strong> c@localhost -o Compression=no ”cat – >\/dev\/null”;
\nEnter passphrase for key ’\/home\/christer\/.ssh\/id_rsa’:
\nEnter passphrase for key ’\/home\/christer\/.ssh\/id_rsa’:
\n20000+0 records in
\n20000+0 records out
\n20971520000 bytes (21 GB) copied, 65,9113 s, 318 MB\/s<\/strong>
\n38.74<\/strong> user
\n14.99 system
\n1:05.91 elapsed
\n81% CPU (0avgtext+0avgdata 3268maxresident)k
\n0inputs+0outputs (0major+953minor)pagefaults 0swaps\n<\/p><\/blockquote>\n

\nc@localhost:~$ dd if=\/dev\/zero bs=1M count=20000 conv=sync | time ssh -c aes128-gcm@openssh.com<\/strong> c@localhost -o Compression=no ”cat – >\/dev\/null”;
\n20000+0 records in
\n20000+0 records out
\n20971520000 bytes (21 GB) copied, 42,0884 s, 498 MB\/s<\/strong>
\n22.02<\/strong> user
\n14.77 system
\n0:42.08 elapsed
\n87% CPU (0avgtext+0avgdata 3276maxresident)k
\n0inputs+0outputs (0major+957minor)pagefaults 0swaps\n<\/p><\/blockquote>\n

Det \u00e4r intressant att det \u00e4r framf\u00f6rallt ”user”-tiden som skiljer sig. <\/p>\n

K\u00f6r motsvarande p\u00e5 NAS:en.<\/p>\n

\nnas> dd if=\/dev\/zero bs=1M count=20000 conv=sync | time ssh -c aes128-ctr<\/strong> -p 2222 admin@localhost -o Compression=no ”cat – >\/dev\/null”;
\n20000+0 records in
\n20000+0 records out
\nreal\t5m 13.44s
\nuser\t8m 37.22s<\/strong>
\nsys\t0m 41.28s\n<\/p><\/blockquote>\n

Motsvarar: 64 MB\/s<\/p>\n

\nnas> dd if=\/dev\/zero bs=1M count=20000 conv=sync | time ssh -c aes128-gcm@openssh.com -p 2222 admin@localhost -o Compression=no ”cat – >\/dev\/null”;
\n20000+0 records in
\n20000+0 records out
\nreal\t2m 11.41s
\nuser\t1m 21.78s<\/strong>
\nsys\t0m 37.58s\n<\/p><\/blockquote>\n

Motsvarar: 152 MB\/s<\/p>\n

Jag inspirerades av f\u00f6ljande sida, som hj\u00e4lpte mig p\u00e5 r\u00e4tt v\u00e4g:
\n Openssh 6.7 disables a number of ciphers<\/a><\/p>\n

Edit: Det verkar st\u00e4mma:
\nOpenSSH ciphers performance benchmark (update 2015)<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Jag skulle \u00f6verf\u00f6ra stora m\u00e4ngder lokalt lagrade data till en ny Synology DS415+ NAS. F\u00f6r detta anv\u00e4nde jag rsync \u00f6ver ssh. Initialt kom jag upp i ca 70-80 MB\/s. P\u00e5 NASen l\u00e5g CPU-lasten p\u00e5 ca 70%, framf\u00f6rallt SSH. Det fick mig att fundera p\u00e5 om krypteringsalgoritmen har betydelse. I korthet s\u00e5 fungerar aes128-gcm@openssh.com b\u00e4st f\u00f6r … Forts\u00e4tt l\u00e4sa Effektiv SSH med r\u00e4tt algoritm<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[27,22],"tags":[68,66,64],"_links":{"self":[{"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/posts\/280"}],"collection":[{"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ingby.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=280"}],"version-history":[{"count":2,"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/posts\/280\/revisions"}],"predecessor-version":[{"id":282,"href":"https:\/\/www.ingby.com\/index.php?rest_route=\/wp\/v2\/posts\/280\/revisions\/282"}],"wp:attachment":[{"href":"https:\/\/www.ingby.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ingby.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ingby.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}