REQ - need some OpenSSL numbers/info

[sfx2000]

The Cortex-A53 in a Raspberry Pi 3 should have crypto support according to the specifications, but the reality is that it is not implemented in every A53 soc because of the licenses obtained from ARM.

Someone did test it with the conclusion that the Pi 3 doesn't have crypto support.

https://www.reddit.com/r/raspberry_..._runtime_detection_of_cpu_features_pi3_arm53/

Pick and choose - interesting article over on Phoronix earlier today looking at different ARM hobby board and benchmarks - the ARMv8 machines are pretty impressive...

http://www.phoronix.com/scan.php?page=news_item&px=10-ARM-Benchmarks

 

[kvic]

0.9.8 is now EOL, which means no security patches anymore, unless Apple wants to waste resources maintaining it entirely in-house.

Sent from my Nexus 9 using Tapatalk

0.9.8 ended support on 31 Dec 2015 with last release 0.9.8zh on 3 Dec 2015.

0.9.8zh was only picked up by Apple in latest update OS X 10.11.4/iOS 9.3

They're on their own now. It's unwise to assume Apple hasn't started working on its replacement. Maybe we'll see in 10.12.0 (be it still known as OS X or macOS 11).

 

[sfx2000]

0.9.8 ended support on 31 Dec 2015 with last release 0.9.8zh on 3 Dec 2015.

0.9.8zh was only picked up by Apple in latest update OS X 10.11.4/iOS 9.3

They're on their own now. It's unwise to assume Apple hasn't started working on its replacement. Maybe we'll see in 10.12.0 (be it still known as OS X or macOS 11).

OSX 10.11 keeps OpenSSL around for legacy stuff, but they've depreciated it for SecureTransport, which is their own API...

Trying to build against OpenSSL 0.9.8zh in ElCap is a problem, as the header files are missing..

 

[majeedun]

root@R7000:~# openssl speed aes-128-cbc aes-256-cbc bf-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 6047105 aes-128 cbc's in 3.01s
Doing aes-128 cbc for 3s on 64 size blocks: 1628574 aes-128 cbc's in 2.98s
Doing aes-128 cbc for 3s on 256 size blocks: 416959 aes-128 cbc's in 2.98s
Doing aes-128 cbc for 3s on 1024 size blocks: 105005 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 8192 size blocks: 13152 aes-128 cbc's in 3.00s
Doing aes-256 cbc for 3s on 16 size blocks: 4643500 aes-256 cbc's in 3.01s
Doing aes-256 cbc for 3s on 64 size blocks: 1250626 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 256 size blocks: 319388 aes-256 cbc's in 3.01s
Doing aes-256 cbc for 3s on 1024 size blocks: 80440 aes-256 cbc's in 2.99s
Doing aes-256 cbc for 3s on 8192 size blocks: 10069 aes-256 cbc's in 3.00s
Doing blowfish cbc for 3s on 16 size blocks: 5219026 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 64 size blocks: 1444818 blowfish cbc's in 3.01s
Doing blowfish cbc for 3s on 256 size blocks: 372283 blowfish cbc's in 2.99s
Doing blowfish cbc for 3s on 1024 size blocks: 93791 blowfish cbc's in 2.99s
Doing blowfish cbc for 3s on 8192 size blocks: 11730 blowfish cbc's in 2.99s
OpenSSL 1.0.2g  1 Mar 2016
built on: reproducible build, date unspecified

compiler: ccache arm-linux-uclibc-gcc -I/opt/DEV/src/router/zlib -L/opt/DEV/src/router/zlib -I/opt/DEV/src/router/openssl/crypto -fPIC -I. -I.. -I../include  -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Os -pipe -march=armv7-a -mcpu=cortex-a9 -mtune=cortex-a9 -msoft-float -mfloat-abi=soft -fno-caller-saves -fno-plt -DASMAES512 -ffunction-sections -fdata-sections -I/opt/DEV/src/router/zlib -DNDEBUG -DOPENSSL_NO_ERR -DTERMIO  -fomit-frame-pointer -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
blowfish cbc     27834.81k    30720.38k    31874.40k    32121.06k    32137.85k
aes-128 cbc      32144.08k    34976.09k    35819.30k    35961.58k    35913.73k
aes-256 cbc      24683.06k    26680.02k    27163.90k    27548.68k    27495.08k

 

[sfx2000]

OSX 10.11 keeps OpenSSL around for legacy stuff, but they've depreciated it for SecureTransport, which is their own API...

Trying to build against OpenSSL 0.9.8zh in ElCap is a problem, as the header files are missing..

More info here - they've pretty much replaced most of OpenSSL functionality with their own API - I had to double check in /usr/bin to see if they had a stub or the actual binary, looks like the actual binary, but even then, they may have their own code inside to use SecureTransport as an engine for the bsd userland components.. without seeing the source, it'll be a challenge to confirm.

 

[sfx2000]

forgot the link...

https://developer.apple.com/library/mac/documentation/Security/Reference/secureTransportRef/

 

[kvic]

More info here - they've pretty much replaced most of OpenSSL functionality with their own API

That's right. Apple replaced Openssl with their own Common Crypto libraries for new applications back in 2011 (which btw seems a notable year for both Apple and Intel...lol). They keep shipping openssl 0.9.8 mainly for backward compatibility with applications.

For this reason, I think we won't see Openssl 1.0.x ever being shipped in OS X, There is no need either.

This page recaps well. http://rentzsch.tumblr.com/post/33696323211/wherein-i-write-apples-technote-about-openssl-on

The main 'reason' for the switch is "OpenSSL doesn’t offer API compatibility between versions..."

 

[RMerlin]

More info here - they've pretty much replaced most of OpenSSL functionality with their own API - I had to double check in /usr/bin to see if they had a stub or the actual binary, looks like the actual binary, but even then, they may have their own code inside to use SecureTransport as an engine for the bsd userland components.. without seeing the source, it'll be a challenge to confirm.

That makes sense, especially considering the general "quality" of OpenSSL's code. I just hope that their engineers developing it know what they are doing, as it's hard to evaluate this, the whole thing being closed source (I assume?).

SSL/TLS ain't that easy to implement, if you want it to be really secure.

 

[sfx2000]

That makes sense, especially considering the general "quality" of OpenSSL's code. I just hope that their engineers developing it know what they are doing, as it's hard to evaluate this, the whole thing being closed source (I assume?).

SSL/TLS ain't that easy to implement, if you want it to be really secure.

I'll refrain from any bashing on the OpenSSL group, as they're under a lot of visibility for a couple of widely publicized bugs, and the recent forking of LibreSSL - as RMerlin mentions above, SSL/TLS is non-trivial to implement securely...

The fact that the API shifts around - that's just the nature of Free and Open Source projects - new things get added, old things sometimes go away (or turn into Zombie code that get's folks worried in the middle of the night).

 

[kvic]

At the best moments of her 40 year long history, no one will doubt Apple hasn't hired some of the best minds in the industry and challenge if they could get crypto implemented properly.

Only time will tell...just like when Microsoft was beating Netscape with IE4 which turned out so buggy jeopardising the whole platform. But hey...when IE4 was cool, anyone questioned if the smart dudes there hadn't done a proper job?

 

[sfx2000]

Interesting enough... SSL is a lot more than just browsers, and this is a side bar...

I guess is not what percent, but where that percent is...

 

[sfx2000]

Interesting enough... SSL is a lot more than just browsers, and this is a side bar...

View attachment 5920

I guess is not what percent, but where that percent is...

Would be interesting to see the SNB (Core/Forums) stats are - my guess is more towards Firefox, and then Chrome, and we have a decent Mac community running Safari... with many being cross platform.

 

[RMerlin]

Would be interesting to see the SNB (Core/Forums) stats are - my guess is more towards Firefox, and then Chrome, and we have a decent Mac community running Safari... with many being cross platform.

I can share the asuswrt.lostrealm.ca stats from March 2016. They look quite close to those you posted (I bet that many of these Unknown are Chrome in Incognito mode):

 

[sfx2000]

Thought I would throw some numbers out on Armada 380/385 @ 1.6GHz - similar to the Broadcom SoC's, it's a vanilla ARMv7 Cortex-A9 dual core...

The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
blowfish cbc 29817.64k 31649.17k 32004.52k 32087.16k 32226.45k
aes-128 cbc 51975.55k 56637.65k 58510.21k 58654.72k 58840.41k
aes-256 cbc 40014.20k 42613.78k 43574.53k 43790.68k 43808.09k

AES-128 is the sweet spot for most ARM's these days - and I'd bet that QCA numbers would be similar to Broadcom/Marvell...

DD-WRT v3.0-r28788 std (c) 2016 NewMedia-NET GmbH
Release: 01/13/16
root@192.168.1.40's password: 
==========================================================

     ___  ___     _      _____  ______       ____  ___ 
    / _ \/ _ \___| | /| / / _ \/_  __/ _  __|_  / / _ \
   / // / // /___/ |/ |/ / , _/ / /   | |/ //_ <_/ // /
  /____/____/    |__/|__/_/|_| /_/    |___/____(_)___/ 
                                                     
                       DD-WRT v3.0
                   http://www.dd-wrt.com

==========================================================


BusyBox v1.24.1 (2016-01-13 04:14:12 CET) built-in shell (ash)

root@MEDIABOX:~# openssl speed aes-128-cbc aes-256-cbc bf-cbc
WARNING: can't open config file: /etc/ssl/openssl.cnf
Doing aes-128 cbc for 3s on 16 size blocks: 9745416 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 64 size blocks: 2654890 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 256 size blocks: 683381 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 1024 size blocks: 171840 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 21548 aes-128 cbc's in 3.00s
Doing aes-256 cbc for 3s on 16 size blocks: 7477653 aes-256 cbc's in 2.99s
Doing aes-256 cbc for 3s on 64 size blocks: 1997521 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 256 size blocks: 510639 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 1024 size blocks: 128293 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 8192 size blocks: 16043 aes-256 cbc's in 3.00s
Doing blowfish cbc for 3s on 16 size blocks: 5572172 blowfish cbc's in 2.99s
Doing blowfish cbc for 3s on 64 size blocks: 1483555 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 256 size blocks: 375053 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 1024 size blocks: 93692 blowfish cbc's in 2.99s
Doing blowfish cbc for 3s on 8192 size blocks: 11723 blowfish cbc's in 2.98s
OpenSSL 1.0.2e 3 Dec 2015
built on: reproducible build, date unspecified

compiler: ccache arm-openwrt-linux-gcc -I/home/seg/DEV/mvebu/src/router/zlib -L/home/seg/DEV/mvebu/src/router/zlib -I/home/seg/DEV/mvebu/src/router/openssl/crypto -fPIC -I. -I.. -I../include  -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Os -pipe -march=armv7-a -mcpu=cortex-a9 -mtune=cortex-a9 -mfpu=vfpv3-d16 -mfloat-abi=softfp -fno-caller-saves -DASMAES512 -ffunction-sections -fdata-sections -I/home/seg/DEV/mvebu/src/router/zlib -DNDEBUG -DOPENSSL_NO_ERR -DTERMIO  -fomit-frame-pointer -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
blowfish cbc     29817.64k    31649.17k    32004.52k    32087.16k    32226.45k
aes-128 cbc      51975.55k    56637.65k    58510.21k    58654.72k    58840.41k
aes-256 cbc      40014.20k    42613.78k    43574.53k    43790.68k    43808.09k

root@MEDIABOX:~# cat /proc/cpuinfo
model name    : ARMv7 Processor rev 1 (v7l)
processor    : 0
BogoMIPS    : 3188.32
Features    : half thumb fastmult vfp edsp vfpv3 tls vfpd32 
CPU implementer    : 0x41
CPU architecture: 7
CPU variant    : 0x4
CPU part    : 0xc09
CPU revision    : 1

model name    : ARMv7 Processor rev 1 (v7l)
processor    : 1
BogoMIPS    : 3195.69
Features    : half thumb fastmult vfp edsp vfpv3 tls vfpd32 
CPU implementer    : 0x41
CPU architecture: 7
CPU variant    : 0x4
CPU part    : 0xc09
CPU revision    : 1

Hardware    : Marvell Armada 380/385 (Device Tree)
Revision    : 0000
Serial        : 0000000000000000

 

[sfx2000]

Just for fun - Raspberry Pi 2 - model B - Ubuntu Mate 16.04 - have this in testing for a different project (relevant to many on SNBForums)

=================

cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 5 (v7l)
BogoMIPS : 38.40
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 5

processor : 1
model name : ARMv7 Processor rev 5 (v7l)
BogoMIPS : 38.40
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 5

processor : 2
model name : ARMv7 Processor rev 5 (v7l)
BogoMIPS : 38.40
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 5

processor : 3
model name : ARMv7 Processor rev 5 (v7l)
BogoMIPS : 38.40
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 5

Hardware : BCM2709
Revision : a21041
Serial : 00000000ce0efd8e

=================

$ openssl speed aes-128-cbc aes-256-cbc bf-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 3845427 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 64 size blocks: 1044986 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 256 size blocks: 266537 aes-128 cbc's in 2.98s
Doing aes-128 cbc for 3s on 1024 size blocks: 67354 aes-128 cbc's in 2.98s
Doing aes-128 cbc for 3s on 8192 size blocks: 8555 aes-128 cbc's in 3.00s
Doing aes-256 cbc for 3s on 16 size blocks: 2986977 aes-256 cbc's in 2.99s
Doing aes-256 cbc for 3s on 64 size blocks: 798559 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 256 size blocks: 204189 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 1024 size blocks: 51264 aes-256 cbc's in 2.99s
Doing aes-256 cbc for 3s on 8192 size blocks: 6410 aes-256 cbc's in 3.00s
Doing blowfish cbc for 3s on 16 size blocks: 3367136 blowfish cbc's in 2.99s
Doing blowfish cbc for 3s on 64 size blocks: 933355 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 256 size blocks: 239779 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 1024 size blocks: 60233 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 8192 size blocks: 7550 blowfish cbc's in 3.00s
OpenSSL 1.0.2g-fips 1 Mar 2016
built on: reproducible build, date unspecified
options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) blowfish(ptr)
compiler: cc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
blowfish cbc 18018.12k 19911.57k 20461.14k 20559.53k 20616.53k
aes-128 cbc 20577.54k 22367.59k 22897.14k 23144.46k 23360.85k
aes-256 cbc 15983.82k 17035.93k 17424.13k 17556.63k 17503.57k

 

[RMerlin]

If you want more numbers, check Kong's results, including one of them with HW acceleration enabled:

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=287177&postdays=0&postorder=asc&start=0

 

[sfx2000]

If you want more numbers, check Kong's results, including one of them with HW acceleration enabled:

They've been having some difficulty with the Armada's - the 385 is a bit different than the older XP, and Marvell doesn't document things all that well (secret sauce), but when it works, it's really fast...

Sometimes a bit faster than Intel's AES-NI numbers on similar HW - Cortex-A9 Dual compared to Silvermont Dual at similar speeds (Baytrail T, Braswell, Rangely without QuickAssist..)

QuickAssist is also bonkers - the FreeBSD fiends are working hard to get that into pfSense and other FreeBSD oriented distros.. but that'll take a fair amount of rewrite for it to happen for us folks out here in the trenches..

 

[Pila]

Raspberry Pi 3 OpenELEC (official) Version: 6.0.3
ARMv7 Processor rev 4 (v7l) 4core, Hardware: BCM2709, Revision: a02082

# openssl speed aes-128-cbc aes-256-cbc bf-cbc
WARNING: can't open config file: /etc/ssl/openssl.cnf
Doing aes-128 cbc for 3s on 16 size blocks: 5319915 aes-128 cbc's in 2.98s
Doing aes-128 cbc for 3s on 64 size blocks: 1514834 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 256 size blocks: 367839 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 1024 size blocks: 88046 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 10383 aes-128 cbc's in 3.00s
Doing aes-256 cbc for 3s on 16 size blocks: 3325739 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 64 size blocks: 898661 aes-256 cbc's in 2.99s
Doing aes-256 cbc for 3s on 256 size blocks: 224745 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 1024 size blocks: 55593 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 8192 size blocks: 6939 aes-256 cbc's in 3.00s
Doing blowfish cbc for 3s on 16 size blocks: 4366201 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 64 size blocks: 1251892 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 256 size blocks: 319360 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 1024 size blocks: 81104 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 8192 size blocks: 10141 blowfish cbc's in 3.00s
LibreSSL 2.1.8
built on: date not available
options:bn(64,32) rc4(ptr,int) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(idx)
compiler: information not available
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
blowfish cbc     23286.41k    26707.03k    27252.05k    27683.50k    27691.69k
aes-128 cbc      28563.30k    32316.46k    31388.93k    30053.03k    28352.51k
aes-256 cbc      17737.27k    19235.55k    19178.24k    18975.74k    18948.10k

QNAP TS-253A-4G 14nm quad-core Intel Celeron N3150 1.6 Hz (burst up to 2.08GHz)

[~] # openssl speed aes-128-cbc aes-256-cbc bf-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 6983012 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 64 size blocks: 1956952 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 256 size blocks: 511712 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 1024 size blocks: 245155 aes-128 cbc's in 2.97s
Doing aes-128 cbc for 3s on 8192 size blocks: 31167 aes-128 cbc's in 2.99s
Doing aes-256 cbc for 3s on 16 size blocks: 5144298 aes-256 cbc's in 2.98s
Doing aes-256 cbc for 3s on 64 size blocks: 1408402 aes-256 cbc's in 2.98s
Doing aes-256 cbc for 3s on 256 size blocks: 366681 aes-256 cbc's in 2.98s
Doing aes-256 cbc for 3s on 1024 size blocks: 181257 aes-256 cbc's in 2.98s
Doing aes-256 cbc for 3s on 8192 size blocks: 22918 aes-256 cbc's in 2.99s
Doing blowfish cbc for 3s on 16 size blocks: 13069409 blowfish cbc's in 2.98s
Doing blowfish cbc for 3s on 64 size blocks: 3506740 blowfish cbc's in 2.99s
Doing blowfish cbc for 3s on 256 size blocks: 893104 blowfish cbc's in 2.98s
Doing blowfish cbc for 3s on 1024 size blocks: 224680 blowfish cbc's in 2.98s
Doing blowfish cbc for 3s on 8192 size blocks: 28148 blowfish cbc's in 2.99s
OpenSSL 1.0.1s  1 Mar 2016
built on: Thu Mar 10 20:24:54 2016
options:bn(64,32) rc4(8x,mmx) des(ptr,risc1,16,long) aes(partial) idea(int) blowfish(idx)
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -O3 -fomit-frame-pointer -Wall -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
blowfish cbc     70171.32k    75060.66k    76723.03k    77205.48k    77119.87k
aes-128 cbc      37367.29k    41887.94k    43812.13k    84524.82k    85391.33k
aes-256 cbc      27620.39k    30247.56k    31500.11k    62284.28k    62790.72k
[~] #

 

[Marc66]

Here's a few numbers:

Asus RT-AC66U with Merlin 58

ASUSWRT-Merlin RT-AC66U_3.0.0.4 Sun Mar 20 19:52:51 UTC 2016
admin@RT-AC66U:/tmp/home/root# openssl speed aes-128-cbc aes-256-cbc bf-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 2052689 aes-128 cbc's in 2.95s
Doing aes-128 cbc for 3s on 64 size blocks: 563530 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 256 size blocks: 145163 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 1024 size blocks: 36410 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 4554 aes-128 cbc's in 2.98s
Doing aes-256 cbc for 3s on 16 size blocks: 1571264 aes-256 cbc's in 2.98s
Doing aes-256 cbc for 3s on 64 size blocks: 421706 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 256 size blocks: 104692 aes-256 cbc's in 2.92s
Doing aes-256 cbc for 3s on 1024 size blocks: 27054 aes-256 cbc's in 2.97s
Doing aes-256 cbc for 3s on 8192 size blocks: 3315 aes-256 cbc's in 2.92s
Doing blowfish cbc for 3s on 16 size blocks: 2217896 blowfish cbc's in 2.98s
Doing blowfish cbc for 3s on 64 size blocks: 582087 blowfish cbc's in 2.90s
Doing blowfish cbc for 3s on 256 size blocks: 153021 blowfish cbc's in 2.96s
Doing blowfish cbc for 3s on 1024 size blocks: 38319 blowfish cbc's in 2.96s
Doing blowfish cbc for 3s on 8192 size blocks: 4787 blowfish cbc's in 2.97s
OpenSSL 1.0.2g  1 Mar 2016
built on: reproducible build, date unspecified
options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr)
compiler: mipsel-uclibc-gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -ffunction-sections -fdata-sections -mips2 -mabi=32 -O3 -Wall -DBN_DIV3W -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DAES_ASM
The 'numbers' are in 1000s of bytes per second processed.
type          16 bytes   64 bytes   256 bytes  1024 bytes  8192 bytes
blowfish cbc  11908.17k  12846.06k  13234.25k  13256.30k   13203.74k
aes-128 cbc   11133.23k  12021.97k  12387.24k  12427.95k   12518.92k
aes-256 cbc    8436.32k   8996.39k   9178.48k   9327.71k    9300.16k

admin@RT-AC66U:/tmp/home/root# nvram get clkfreq
600,300,150

admin@RT-AC66U:/tmp/home/root# cat /proc/cpuinfo
system type  : Broadcom BCM5300 chip rev 1
processor  : 0
cpu model  : MIPS 74K V4.9
BogoMIPS  : 299.82
wait instruction  : no
microsecond timers  : yes
tlb_entries  : 64
extra interrupt vector  : no
hardware watchpoint  : yes
ASEs implemented  : mips16 dsp
shadow register sets  : 1
VCED exceptions  : not available
VCEI exceptions  : not available

unaligned_instructions  : 128
dcache hits  : 2147483648
dcache misses  : 0
icache hits  : 2147483648
icache misses  : 0
instructions  : 2147483648

Dreambox DM8000

satdreamgr-openpli 4 dm8000
root@dm8000:~# openssl speed aes-128-cbc aes-256-cbc bf-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 757140 aes-128 cbc's in 2.87s
Doing aes-128 cbc for 3s on 64 size blocks: 221355 aes-128 cbc's in 2.98s
Doing aes-128 cbc for 3s on 256 size blocks: 57149 aes-128 cbc's in 2.97s
Doing aes-128 cbc for 3s on 1024 size blocks: 14387 aes-128 cbc's in 2.94s
Doing aes-128 cbc for 3s on 8192 size blocks: 1807 aes-128 cbc's in 2.89s
Doing aes-256 cbc for 3s on 16 size blocks: 616627 aes-256 cbc's in 2.85s
Doing aes-256 cbc for 3s on 64 size blocks: 166333 aes-256 cbc's in 2.82s
Doing aes-256 cbc for 3s on 256 size blocks: 43301 aes-256 cbc's in 2.86s
Doing aes-256 cbc for 3s on 1024 size blocks: 10882 aes-256 cbc's in 2.84s
Doing aes-256 cbc for 3s on 8192 size blocks: 1357 aes-256 cbc's in 2.84s
Doing blowfish cbc for 3s on 16 size blocks: 785390 blowfish cbc's in 2.88s
Doing blowfish cbc for 3s on 64 size blocks: 213561 blowfish cbc's in 2.85s
Doing blowfish cbc for 3s on 256 size blocks: 54203 blowfish cbc's in 2.85s
Doing blowfish cbc for 3s on 1024 size blocks: 13280 blowfish cbc's in 2.84s
Doing blowfish cbc for 3s on 8192 size blocks: 1720 blowfish cbc's in 2.84s
OpenSSL 1.0.1j 15 Oct 2014
built on: Fri Oct 16 09:37:58 EEST 2015
options:bn(64,32) rc4(idx,int) des(idx,risc2,16,long) aes(partial) idea(int) blowfish(idx)
compiler: mipsel-oe-linux-gcc  -mel -mabi=32 -mhard-float -march=mips32 --sysroot=/opt/openpli/openpli4/build/tmp/sysroots/dm500hd -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN  -DTERMIO  -Os -pipe -g -feliminate-unused-debug-types -Wall -Wa,--noexecstack -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS
The 'numbers' are in 1000s of bytes per second processed.
type          16 bytes  64 bytes  256 bytes  1024 bytes  8192 bytes
blowfish cbc  4363.28k  4795.76k  4868.76k   4788.28k    4961.35k
aes-128 cbc   4220.99k  4753.93k  4925.97k   5010.98k    5122.13k
aes-256 cbc   3461.77k  3774.93k  3875.89k   3923.65k    3914.28k

root@dm8000:~# cat /proc/cpuinfo
system type  : BCM7400D2 STB platform
processor  : 0
cpu model  : Brcm4380 V4.2  FPU V0.1
BogoMIPS  : 403.45
cpu MHz  : 405.016
wait instruction  : yes
microsecond timers  : yes
tlb_entries  : 32
extra interrupt vector  : yes
hardware watchpoint  : no
ASEs implemented  : mips16
shadow register sets  : 1
kscratch registers  : 0
core  : 0
VCED exceptions  : not available
VCEI exceptions  : not available

processor  : 1
cpu model  : Brcm4380 V4.2  FPU V0.1
BogoMIPS  : 403.45
cpu MHz  : 405.016
wait instruction  : yes
microsecond timers  : yes
tlb_entries  : 32
extra interrupt vector  : yes
hardware watchpoint  : no
ASEs implemented  : mips16
shadow register sets  : 1
kscratch registers  : 0
core  : 0
VCED exceptions  : not available
VCEI exceptions  : not available

QNAP TS-470

[~] # openssl speed aes-128-cbc aes-256-cbc bf-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 15199481 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 64 size blocks: 4301787 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 256 size blocks: 1108166 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 1024 size blocks: 279166 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 35092 aes-128 cbc's in 3.00s
Doing aes-256 cbc for 3s on 16 size blocks: 11205326 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 64 size blocks: 3090154 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 256 size blocks: 790739 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 1024 size blocks: 199351 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 8192 size blocks: 24970 aes-256 cbc's in 3.00s
Doing blowfish cbc for 3s on 16 size blocks: 15985422 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 64 size blocks: 4118107 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 256 size blocks: 1037606 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 1024 size blocks: 259720 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 8192 size blocks: 32495 blowfish cbc's in 3.00s
OpenSSL 1.0.1s  1 Mar 2016
built on: Thu Mar 10 20:24:54 2016
options:bn(64,32) rc4(8x,mmx) des(ptr,risc1,16,long) aes(partial) idea(int) blowfish(idx)
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -O3 -fomit-frame-pointer -Wall -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type          16 bytes   64 bytes   256 bytes  1024 bytes  8192 bytes
blowfish cbc  85255.58k  87852.95k  88542.38k  88651.09k   88733.01k
aes-128 cbc   81063.90k  92078.38k  94563.50k  95288.66k   95824.55k
aes-256 cbc   59761.74k  65923.29k  67476.39k  68045.14k   68184.75k

# cat /proc/cpuinfo
model name  : Intel(R) Celeron(R) CPU G550 @ 2.60GHz

iMac late 2009 on OSX 10.9.5

root@iMac:~$ openssl speed aes-128-cbc aes-256-cbc bf-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 27201462 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 64 size blocks: 7069215 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 256 size blocks: 1764869 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 1024 size blocks: 447159 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 56052 aes-128 cbc's in 3.00s
Doing aes-256 cbc for 3s on 16 size blocks: 21106985 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 64 size blocks: 5437436 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 256 size blocks: 1359766 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 1024 size blocks: 343030 aes-256 cbc's in 3.00s
Doing aes-256 cbc for 3s on 8192 size blocks: 42890 aes-256 cbc's in 3.00s
Doing blowfish cbc for 3s on 16 size blocks: 21532984 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 64 size blocks: 5755107 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 256 size blocks: 1475536 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 1024 size blocks: 370628 blowfish cbc's in 3.00s
Doing blowfish cbc for 3s on 8192 size blocks: 46405 blowfish cbc's in 3.00s
OpenSSL 0.9.8zg 14 July 2015
built on: Jul 19 2015
options:bn(64,64) md2(int) rc4(ptr,char) des(idx,cisc,16,int) aes(partial) blowfish(idx)
compiler: -arch x86_64 -fmessage-length=0 -pipe -Wno-trigraphs -fpascal-strings -fasm-blocks -O3 -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -DMD32_REG_T=int -DOPENSSL_NO_IDEA -DOPENSSL_PIC -DOPENSSL_THREADS -DZLIB -mmacosx-version-min=10.6
available timing options: TIMEB USE_TOD HZ=100 [sysconf value]
timing function used: getrusage
The 'numbers' are in 1000s of bytes per second processed.
type          16 bytes    64 bytes    256 bytes   1024 bytes  8192 bytes
blowfish cbc  114827.69k  122753.93k  125907.66k  126486.27k  126740.16k
aes-128 cbc   145055.95k  150783.18k  150638.16k  152606.72k  153036.73k
aes-256 cbc   112553.29k  115983.63k  116013.84k  117069.12k  117132.08k

root@iMac:~$ sysctl -n machdep.cpu.brand_string
Intel(R) Core(TM) i7 CPU  860  @ 2.80GHz

 

[sfx2000]

Give this little test a try...

http://www.snbforums.com/threads/openvpn-estimate-performance-via-openvpn.33416/

Probably a better estimate of OpenVPN potential performance under ideal conditions...