Skip to content

Instantly share code, notes, and snippets.

@Splat

Splat/fast_hash.md

Last active November 3, 2017 20:17
Show Gist options
  • Save Splat/b785c91bf0054d1759f3d0059fc30eb0 to your computer and use it in GitHub Desktop.
Save Splat/b785c91bf0054d1759f3d0059fc30eb0 to your computer and use it in GitHub Desktop.
Download ZIP
secure ciphers, keys, and macs for optimal performance for things like SSH and SCP
Raw
fast_hash.md

Fast and secure

When using things like SSH and SCP at scale across many hosts, it's important to trim available cipher suites. Rolling through all ciphers suites until a match is found can be time costly. At the very least you should trim your client and proxies to use a limited set of valid ciphers. It's also valuable to limit on the server side too in order to avoid keys and certificates using corrupted ciphers.

List of Algos

Below is what I deem to be the best security/performance configurations for an optimal path.

KexAlgorithms

ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256

Ciphers

aes192-ctr,aes256-ctr,aes192-cbc,aes256-cbc

Macs

hmac-sha2-256,hmac-sha2-512

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment