Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are the differences between the arcfour, arcfour128 and arcfour256 ciphers in OpenSSH?

I am interested about: speed and security implications.

I know that arcfour is fast for file transfers, but I don't know which one to pick.

share|improve this question
1  
If you want fast file transfers over SSH, consider using psc.edu/index.php/hpn-ssh . –  Matrix Jan 9 '13 at 14:41
add comment

1 Answer

up vote 11 down vote accepted

The "arcfour" cipher is defined in RFC 4253; it is plain RC4 with a 128-bit key.

"arcfour128" and "arcfour256" are defined in RFC 4345. They use a key of 128-bit or 256-bit, respectively. Moreover, and contrary to plain "arcfour", they also include a "discard" step: the very first 1536 bytes produced by the cipher are dropped. This is done because the first bytes of RC4 output tend to exhibit biases, which are rarely fatal to your security, but worrisome nonetheless. "arcfour128" and "arcfour256" are thus "more secure" than plain "arcfour".

Note that the extended key size of arcfour256 does not buy you much: a 128-bit key is already more than enough to defeat key cracking through brute force. A 256-bit key is more for aesthetic than rational reasons (there is a widespread belief among auditors that bigger keys are always better, just like there is a widespread belief among people in general that bigger cars are always better).

Note also that while dropping the first 1536 bytes of output fixes issues with the biases in the first 1536 bytes (of course...), it does nothing against the other biases in RC4 output (RC4 output can be distinguished from randomness after about one gigabyte). There again, these biases have never proven fatal in any deployed protocol; however, they "look bad" in audit conditions.

As for performance, there shall be no difference whatsoever, since RC4 speed does not depend upon key size. The extra 1536 bytes implied by arcfour128 and arcfour256 theoretically induce a small one-time extra cost, but that's way below the millisecond worth of CPU even on an asthmatic embedded ARM or Mips, so this would be very hard to even detect in practice.

Summary: use arcfour128 when possible, fallback to arcfour. Use arcfour256 if you need to impress bureaucrats by spewing out huge numbers that they will not understand, but which will cow them into submission.

However, network is usually the bottleneck, so even over gigabit ethernet, AES-based ciphers should provide the same actual speed than RC4, and with arguably better security (even in the skewed view of auditors). If unsure, measure; don't believe one cipher to be faster than another because you read it as some old lore which was thought out at a time when a PentiumPro was the summit of Earth-based technology.

share|improve this answer
    
Modern CPUs have AES instructions, and with these a ciphersuite like AES-GCM should be really fast. –  CodesInChaos Jan 9 '13 at 14:25
1  
...which is all the more a good reason to make measures on the actual hardware. –  Thomas Pornin Jan 9 '13 at 14:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.