OpenSSH slow on OSX High Sierra (maybe due to libcrypto)?

Fri Jul 13 13:42:34 AEST 2018

Hi,

> If anyone has such a machine handy, could you please run "sysctl
> machdep.cpu.brand_string; /usr/bin/openssl speed rsa" and post the
> results for comparison?

I've included results from the (much slower) macports openssl build too.

On a 2009 iMac:
$ sysctl machdep.cpu.brand_string
machdep.cpu.brand_string: Intel(R) Core(TM)2 Duo CPU     E7600  @ 3.06GHz
$ uname -a
Darwin ... 17.7.0 Darwin Kernel Version 17.7.0: Thu Jun 21 22:53:14 PDT 2018; root:xnu-4570.71.2~1/RELEASE_X86_64 x86_64
$ /usr/bin/openssl speed rsa
Doing 512 bit private rsa's for 10s: 8244 512 bit private RSA's in 8.66s
Doing 512 bit public rsa's for 10s: 91959 512 bit public RSA's in 9.04s
Doing 1024 bit private rsa's for 10s: 1512 1024 bit private RSA's in 9.65s
Doing 1024 bit public rsa's for 10s: 31387 1024 bit public RSA's in 9.81s
Doing 2048 bit private rsa's for 10s: 241 2048 bit private RSA's in 9.49s
Doing 2048 bit public rsa's for 10s: 8382 2048 bit public RSA's in 9.49s
Doing 4096 bit private rsa's for 10s: 36 4096 bit private RSA's in 9.63s
Doing 4096 bit public rsa's for 10s: 2240 4096 bit public RSA's in 9.26s
LibreSSL 2.2.7
built on: date not available
options:bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) aes(partial) blowfish(idx) 
compiler: information not available
                  sign    verify    sign/s verify/s
rsa  512 bits 0.001050s 0.000098s    952.0  10172.5
rsa 1024 bits 0.006382s 0.000313s    156.7   3199.5
rsa 2048 bits 0.039378s 0.001132s     25.4    883.2
rsa 4096 bits 0.267500s 0.004134s      3.7    241.9
$ /opt/local/bin/openssl speed rsa
Doing 512 bit private rsa's for 10s: 83569 512 bit private RSA's in 9.02s
Doing 512 bit public rsa's for 10s: 965220 512 bit public RSA's in 8.93s
Doing 1024 bit private rsa's for 10s: 29196 1024 bit private RSA's in 9.16s
Doing 1024 bit public rsa's for 10s: 452033 1024 bit public RSA's in 9.69s
Doing 2048 bit private rsa's for 10s: 3671 2048 bit private RSA's in 8.05s
Doing 2048 bit public rsa's for 10s: 75199 2048 bit public RSA's in 5.04s
Doing 4096 bit private rsa's for 10s: 596 4096 bit private RSA's in 9.56s
Doing 4096 bit public rsa's for 10s: 37562 4096 bit public RSA's in 9.37s
OpenSSL 1.0.2o  27 Mar 2018
built on: reproducible build, date unspecified
options:bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
compiler: /usr/bin/clang -I. -I.. -I../include  -fPIC -fno-common -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -arch x86_64 -O3 -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
                  sign    verify    sign/s verify/s
rsa  512 bits 0.000108s 0.000009s   9264.9 108087.3
rsa 1024 bits 0.000314s 0.000021s   3187.3  46649.4
rsa 2048 bits 0.002193s 0.000067s    456.0  14920.4
rsa 4096 bits 0.016040s 0.000249s     62.3   4008.8

On a 2011 Mac Mini server:
$ uname -a
Darwin ... 17.6.0 Darwin Kernel Version 17.6.0: Tue May  8 15:22:16 PDT 2018; root:xnu-4570.61.1~1/RELEASE_X86_64 x86_64
$ sysctl machdep.cpu.brand_string
machdep.cpu.brand_string: Intel(R) Core(TM) i7-2635QM CPU @ 2.00GHz
$  /usr/bin/openssl speed rsa
Doing 512 bit private rsa's for 10s: 10541 512 bit private RSA's in 10.01s
Doing 512 bit public rsa's for 10s: 170035 512 bit public RSA's in 10.00s
Doing 1024 bit private rsa's for 10s: 1683 1024 bit private RSA's in 10.01s
Doing 1024 bit public rsa's for 10s: 38692 1024 bit public RSA's in 10.01s
Doing 2048 bit private rsa's for 10s: 257 2048 bit private RSA's in 10.03s
Doing 2048 bit public rsa's for 10s: 9275 2048 bit public RSA's in 10.00s
Doing 4096 bit private rsa's for 10s: 39 4096 bit private RSA's in 10.24s
Doing 4096 bit public rsa's for 10s: 2516 4096 bit public RSA's in 10.01s
LibreSSL 2.2.7
built on: date not available
options:bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) aes(partial) blowfish(idx) 
compiler: information not available
                  sign    verify    sign/s verify/s
rsa  512 bits 0.000950s 0.000059s   1053.0  17003.5
rsa 1024 bits 0.005948s 0.000259s    168.1   3865.3
rsa 2048 bits 0.039027s 0.001078s     25.6    927.5
rsa 4096 bits 0.262564s 0.003979s      3.8    251.3
$ /opt/local/bin/openssl speed rsa
Doing 512 bit private rsa's for 10s: 124906 512 bit private RSA's in 9.98s
Doing 512 bit public rsa's for 10s: 1395820 512 bit public RSA's in 9.98s
Doing 1024 bit private rsa's for 10s: 45272 1024 bit private RSA's in 9.99s
Doing 1024 bit public rsa's for 10s: 640749 1024 bit public RSA's in 9.98s
Doing 2048 bit private rsa's for 10s: 6342 2048 bit private RSA's in 9.97s
Doing 2048 bit public rsa's for 10s: 214408 2048 bit public RSA's in 9.98s
Doing 4096 bit private rsa's for 10s: 900 4096 bit private RSA's in 9.96s
Doing 4096 bit public rsa's for 10s: 58470 4096 bit public RSA's in 9.96s
OpenSSL 1.0.2o  27 Mar 2018
built on: reproducible build, date unspecified
options:bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
compiler: /usr/bin/clang -I. -I.. -I../include  -fPIC -fno-common -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -arch x86_64 -O3 -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
                  sign    verify    sign/s verify/s
rsa  512 bits 0.000080s 0.000007s  12515.6 139861.7
rsa 1024 bits 0.000221s 0.000016s   4531.7  64203.3
rsa 2048 bits 0.001572s 0.000047s    636.1  21483.8
rsa 4096 bits 0.011067s 0.000170s     90.4   5870.5

On a more recent Mac Mini (five years old? Anyway, it's the last model with configurable memory):
$ uname -a
Darwin ... 17.7.0 Darwin Kernel Version 17.7.0: Thu Jun 21 22:53:14 PDT 2018; root:xnu-4570.71.2~1/RELEASE_X86_64 x86_64
$ sysctl machdep.cpu.brand_string
machdep.cpu.brand_string: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
$ /usr/bin/openssl speed rsa
Doing 512 bit private rsa's for 10s: 10275 512 bit private RSA's in 9.96s
Doing 512 bit public rsa's for 10s: 161424 512 bit public RSA's in 9.96s
Doing 1024 bit private rsa's for 10s: 1641 1024 bit private RSA's in 9.96s
Doing 1024 bit public rsa's for 10s: 36294 1024 bit public RSA's in 9.97s
Doing 2048 bit private rsa's for 10s: 251 2048 bit private RSA's in 9.99s
Doing 2048 bit public rsa's for 10s: 8943 2048 bit public RSA's in 9.96s
Doing 4096 bit private rsa's for 10s: 38 4096 bit private RSA's in 10.22s
Doing 4096 bit public rsa's for 10s: 2470 4096 bit public RSA's in 9.96s
LibreSSL 2.2.7
built on: date not available
options:bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) aes(partial) blowfish(idx) 
compiler: information not available
                  sign    verify    sign/s verify/s
rsa  512 bits 0.000969s 0.000062s   1031.6  16207.2
rsa 1024 bits 0.006069s 0.000275s    164.8   3640.3
rsa 2048 bits 0.039801s 0.001114s     25.1    897.9
rsa 4096 bits 0.268947s 0.004032s      3.7    248.0
[macports openssl not installed]

Hope this helps :-)

Dylan Harris
--- 
https://dylanharris.org/