Encryption ciphers
nano /etc/ssh/sshd_config
# Encryption
# ----------
# The command "sshd -T | grep macs" shows the supported MAC algorithms.
# aes256-cbc uses AES in cipher-block chaining (CBC) mode, which can be vulnerable.
# aes256-gcm@openssh.com provides both encryption and authentication.
# twofish256-ctr is a good option but not widely supported.
# chacha20-poly1305@openssh.com is faster than AES, especially without AES-NI.
# Run /proc/cpuinfo to check the flags.
# Use aes256-ctr if things break.
Ciphers aes256-gcm@openssh.com
β **Recommended First Choice** β Supported out of the box with OpenSSH.
Provides **high-security encryption** but requires **significant configuration** and may impact performance. Serpent256-CBC is known for its strong encryption design, but its use in modern systems is limited due to its computational overhead.
**Why Serpent?** π
β
**Highly Secure:** Serpent256-CBC was one of the AES competition finalists, designed for strong cryptographic protection.
β
**Resistant to Cryptanalysis:** Unlike AES, Serpent uses **32 rounds of encryption**, making brute-force and differential cryptanalysis significantly harder.
β
**No Known Backdoors:** Unlike AES, where theoretical concerns exist about possible **NSA involvement**, Serpent remains mathematically unbroken.
**Why Not Serpent?** β οΈ
π» **Performance Trade-off:** Serpent is significantly **slower than AES** in software implementations, making it impractical for real-time encryption needs.
π» **Limited Hardware Support:** Unlike AES, Serpent lacks widespread hardware acceleration, increasing CPU load.
π» **Compatibility Issues:** Not natively supported in most modern OpenSSH builds, requiring **custom OpenSSL builds** or patches.
Supported directly out of the box.
Best choice when optimizing resources is needed, e.g., large file transfers.
To ensure optimal performance when transferring large files over SCP, it's important to consider the use of accelerators. Accelerators are components designed to speed up specific operations by offloading them from the main CPU. These components can be either hardware or software-based.
One example of a hardware accelerator that was commonly used in the past is the 3DES accelerator. 3DES is a symmetric-key encryption algorithm that was widely supported by hardware accelerators in the early days of SSH and SCP. The algorithm has since been superseded by the Advanced Encryption Standard (AES), which provides stronger security and is supported by modern CPUs through the AES instruction set.
Recommended Ciphers:Miscellaneous ciphers that are available but may have security concerns.
β These ciphers are considered highly vulnerable and should never be used in secure environments.