Optional 'test' or benchmark cipher

[Michael Stevens]

>
>        Sounds like it is unlikely to provide an "easy" way to remove
> the data encryption from the equation.
>
>        I'm not clear if the HPN-SSH "patch" is a patch over Ossh or
> a different, but depending on how much change HPN-SSH adds, I might
> be benchmarking something that is unrepresentative of Ossh.

The HPN patch lets you select none for encryption. You need to have it
on both ends to make full use of the patch. To use none you have to
have HPN severs on both sides and specify none on the command line.
The patch still does the HMAC because we didn't find a significant
overhead from that and still wanted the functionality.

HPN is a relatively small patch to OpenSSH. When you say OSSH I assume
you are talking about OpenSSH and not Björn's OSSH. OpenSSH != OSSH.

>
>        Most are under 12MB/s (which, I know, sounds like very good
> 100Mbs performance -- cept that I'm expecting Gigabit  performance.
>
>

Did you test blowfish and arcfour? I recall that these were faster
than aes128-cbc when I tested this a few years back with two linux
2.6.x machines. Like Chris said, you should test what speeds you can
get without openssh by using iperf. Compare that to OpenSSH to see the
overhead you are getting from OpenSSH.

>
>        I want to test it both ways. How can I easily tell what is due to
> my network's speed, the SSH protocol, or even the implementation?
> How is it a security hole?  I am proposing that it must be explicitly enabled in sshd_config (allowed on a per-host basis, as it is likely only
> something someone would use with certain "safe" (likely internal-private)
> networks. Also, in order to make certain it comes from a valid machine,
> session authentication should be done "as normal". Only after
> authentication would null be allowed.
>

Test the performance minus any ssh using iperf or some other point to
point testing program. If you want to know the throughput you need to
calculate how much data you are transferring vs. overhead per
transaction, I suggest reading the ssh protocol specs (RFC 4251 etc.).
To see what the implementation overhead is take a look at the
difference between your ssh less transfter, calculated ssh protocol
overhead, and then what you are able to get with none, and a few other
ciphers. If you want to enable none for the HMAC talk to Chris or I
because we have done this before.


Mike