Fastest cipher for use with openssl and x86 (Intel)?

Question

I have a C++ application on Intel x86 using openssl to make a connection to a server. What is the fastest cipher that openssl supports? My implementation is currently using ECDHE-ECDSA-AES128-GCM-SHA256.

I know of the openssl speed command but the supported ciphers don't easily map to the cipher names given to openssl via code.

Does openssl support much-less secure ciphers that are very very fast?

I appreciate i've probably committed blasphemy on here, but it's my requirement :)

If it matters, decryption is more important than encryption.

Answer 1

The cipher you're using is probably the fastest you're going to get on a modern machine using the common ciphers in TLS. There are cipher suites using a variety of symmetric cipher options:

• AES-GCM is the fastest on machines that support AES and carryless multiplication acceleration, like modern Intel chips. AES-128 is faster than AES-256, but in both situations your machine can probably encrypt data faster than it can be sent over the network, even with a 10 Gb/s network card. Both are considered secure.
• ChaCha20-Poly1305 is the fastest option on machines that don't support AES. It's still very fast on pretty much any machine and is secure.
• AES-CBC with HMAC is possible, but in TLS it's not configured especially securely (since it doesn't use encrypt-then-MAC). It's also much slower than AES-GCM on most modern machines since it can't be run in parallel and modern machines have vector AES which does run multiple operations in parallel.
• AES-CCM is an option in the TLS specification, but it's not practically used very much. The 16-byte tag version is more secure than the 8-byte tag version (AES-CCM8) and not any slower. It would only be a good choice if you were certain that both sides supported it and you had AES acceleration but not carryless multiplication (which isn't the case on Intel processors).

There are also other options which are just completely insecure, such as RC4, and typically those are all slower than just using ChaCha20 anyway.

For the key exchange and signature, ECDHE-ECDSA is probably fine. It's secure, it's modern, it's reasonably fast, and you're only doing the key exchange and signature once at the beginning, so it isn't really that important. ECDHE-RSA is also fine. In TLS 1.3, this is not part of the cipher suite, and is negotiated independently.

I would in general recommend that as the client you choose multiple options and simply prefer ECDHE-ECDSA-AES128-GCM-SHA256 because that way if the destination server changes its configuration, your program continues to work. All of AES128-GCM, AES256-GCM, and ChaCha20-Poly1305 are going to be able to max out a 10 Gb/s network card on a single core (at least on my laptop), so in most cases you'll be fine with any of them. That's why, at least with TLS 1.3, explicit cipher suite configuration isn't really necessary.