Re: ssh None cipher

On Sun, Oct 19, 2014 at 10:35 AM, Freddie Cash <fjwcash_at_gmail.com> wrote:

> On Oct 19, 2014 12:46 AM, "John-Mark Gurney" <jmg_at_funkthat.com> wrote:
> >
> > Freddie Cash wrote this message on Sat, Oct 18, 2014 at 10:21 -0700:
> > > On Oct 18, 2014 3:54 AM, "Mark Martinec" <Mark.Martinec+freebsd_at_ijs.si
> >
> > > wrote:
> > > >
> > > > If the purpose of having a none cipher is to have a fast
> > > > file transfer, then one should be using  sysutils/bbcp
> > > > for that purposes. Uses ssd for authentication, and
> > > > opens unencrypted channel(s) for the actual data transfer.
> > > > It's also very fast, can use multiple TCP streams.
> > >
> > > That's an interesting alternative to rsync, scp, and ftp, but doesn't
> help
> > > with zfs send/recv which is where the none cipher really shines.
> > >
> > > Without the none cipher, SSH becomes the bottleneck limiting transfers
> to
> > > around 400 Mbps on a gigabit LAN. With the none cipher, the network
> becomes
> > > the bottleneck limiting transfers to around 920 Mbps on the same
> gigabit
> > > LAN.
> > >
> > > This is between two 8-core AMD Opteron 6200 systems using igb(4) NICs.
> >
> > Are you running on HEAD or possibly 10.x (I believe we have OpenSSL
> > 1.0.x on 10.x)?
>
> Nope, 9.2. And I don't think the 6200 series Opterons have AES-NI.
>
​Correction, the AMD Opteron 6200-series of CPUs to support AES-NI.
However, these storage boxes use AMD Opteron 6128 CPUs.  :(  They do not
support AES-NI.

AES-based ciphers are extremely slow on these systems; the multithreaded
AES-based ciphers are better, but nowhere near what the NONE cipher
provides.  :)

sysutils/bbcp is interesting as an alternative, but it's a lot more complex
than just enabling NONE in OpenSSH.

-- 
Freddie Cash
fjwcash_at_gmail.com