User Tools

Site Tools


cryptography

PGP Keyserver

Hardware Acceleration

Check if AES-NI is enabled

grep -m1 -o aes /proc/cpuinfo

Check speed

openssl speed aes-128-cbc
openssl speed -evp aes-128-cbc

Check OpenSSL throughput

dd if=/dev/zero count=100 bs=1M | ssh -c aes128-cbc localhost "cat >/dev/null"

Performance remarks

Decrypting a 1MB file on the Galaxy Nexus (OMAP 4460 chip)
AES-128-GCM 41.6ms
ChaCha20-Poly1305 13.2ms

AES128 vs AES256 1.38x faster
AES128 faster on desktop due to AES-NI HW Acceleration AES-NI is between 4-8x the performance of AES
ChaCha20-Poly1305 faster on mobile phones or slower HW

OpenSSL Cipher list

# openssl ciphers | sed 's/\:/\n/gi'

OpenSSL Performance test

# openssl speed md5 sha1 sha256 sha512 des des-ede3 aes-128-cbc aes-192-cbc aes-256-cbc rsa2048 dsa2048

My preferred string for now

Functional with HTTP/2 protocol

ssl_session_timeout 180m;
ssl_session_cache shared:SSL:20M;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers !aNULL:ECDHE-RSA-AES128-GCM-SHA256:ECDH+AES128+SHA;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains;";

Test StartTLS

openssl s_client -connect ip:21 -starttls ftp -showcerts
openssl s_client -connect ip:25 -starttls smtp -showcerts

Encrypt tar with password

Compress and encrypt

tar cvfz - * | openssl enc -e -aes128 -out secured.tar.gz

Decrypt and decompress

openssl enc -d -aes128 -in secured.tar.gz | tar xvz -C test

Install additional CA in CentOS / Redhat

place CA here -> /etc/pki/tls/certs/cert.pem
yum install /usr/bin/c_rehash
c_rehash
cryptography.txt · Last modified: 2017/08/08 18:53 by Jan Forman