# What are the differences between these AES ciphers?

• aes128-ctr
• aes192-ctr
• aes256-ctr
• aes128-gcm@openssh.com
• aes256-gcm@openssh.com

Mac Sierra recently deprecated blowfish, but I don't understand use-case differences of other ciphers. This is for testing a remote web project with X11Forwarding. I'm also curious about the last option,

• chacha20-poly1305@openssh.com
• The first three are counter mode AES, the cipher is AES and the mode is counter. 128,192,256 refers to the block (and key) size which is used. The larger block sizes also have a different number of rounds: 10, 12 or 14 respectively. There are also differences in how the round keys are derived. See here for more detail: crypto.stackexchange.com/questions/20/… – Chris Jan 26 '17 at 10:55
• AES GCM is the same cipher (in 128 and 256 bit block sizes) but with a different mode. Galois counter mode (GCM) is highly efficient and sometimes prefered for high throughput applications. – Chris Jan 26 '17 at 10:55
• chacha20-poly1305 is a totally different cipher. ChaCha20 is a variant of the salsa stream cipher Poly1305 is a message authentication code (MAC) algorithm. Google adopted this in their TLS cipher suite shortly followed by OpenSSL. This decision was driven by the desire for better mobile device performance. – Chris Jan 26 '17 at 10:59
• @Chris: AES block size is always 128; only the key size varies. And CTR and GCM are stream modes that don't use the block size anyway. fgrieu's answer is (and was) right. – dave_thompson_085 Jan 27 '17 at 5:11
• @dave_thompson_085 thanks dave! I'd somehow overlooked that only the key size changes. – Chris Jan 27 '17 at 11:07

• for i in ssh -Q cipher; do dd if=/dev/zero bs=1M count=100 2> /dev/null | ssh -c $i localhost "(time -p cat) > /dev/null" 2>&1 | grep real | awk '{print "'$i': "100 / \$2" MB/s" }'; done shows for me that aes256-ctr is the fastest (faster than aes128-ctr), but that aes128-gcm@openssh.com is faster than aes256-gcm@openssh.com. – inetknght Dec 13 '19 at 16:33