AES_GCM和AES_CCM的选择

Question

最近在研究nginx的ssl_ciphers,发现服务器普遍使用AES_GCM作为cipher,但我用openssl speed测试发现:其实AES_CCM的处理速度占优,比AES_GCM快两个数量级.

而AES_GCM和AES_CCM又提供了同等级的安全性,基于什么考虑选择AES_GCM呢?

⋊> ~ openssl speed -elapsed -evp aes-128-gcm                                                                                                                                          12:01:25
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-128-gcm for 3s on 16 size blocks: 97979075 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 64 size blocks: 59422372 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 256 size blocks: 29006722 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 1024 size blocks: 11353862 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 8192 size blocks: 1765209 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 16384 size blocks: 895929 aes-128-gcm's in 3.00s
OpenSSL 1.1.1-dev  xx XXX xxxx
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr) 
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib/engines-1.1\""  -Wa,--noexecstack
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-128-gcm     522555.07k  1267677.27k  2475240.28k  3875451.56k  4820197.38k  4892966.91k

⋊> ~ openssl speed -elapsed -evp aes-128-ccm                                                                                                                                          12:01:45
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-128-ccm for 3s on 16 size blocks: 119658614 aes-128-ccm's in 3.00s
Doing aes-128-ccm for 3s on 64 size blocks: 119826773 aes-128-ccm's in 3.00s
Doing aes-128-ccm for 3s on 256 size blocks: 119907412 aes-128-ccm's in 3.00s
Doing aes-128-ccm for 3s on 1024 size blocks: 120247420 aes-128-ccm's in 3.00s
Doing aes-128-ccm for 3s on 8192 size blocks: 119976321 aes-128-ccm's in 3.00s
Doing aes-128-ccm for 3s on 16384 size blocks: 120088122 aes-128-ccm's in 3.00s
OpenSSL 1.1.1-dev  xx XXX xxxx
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr) 
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib/engines-1.1\""  -Wa,--noexecstack
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-128-ccm     638179.27k  2556304.49k 10232099.16k 41044452.69k 327615340.54k 655841263.62k

⋊> ~ openssl speed -decrypt -elapsed -evp aes-128-gcm                                                                                                                                 12:08:04
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-128-gcm for 3s on 16 size blocks: 81282951 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 64 size blocks: 59261806 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 256 size blocks: 30926527 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 1024 size blocks: 11984041 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 8192 size blocks: 1795430 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 16384 size blocks: 906534 aes-128-gcm's in 3.00s
OpenSSL 1.1.1-dev  xx XXX xxxx
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr) 
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib/engines-1.1\""  -Wa,--noexecstack
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-128-gcm     433509.07k  1264251.86k  2639063.64k  4090552.66k  4902720.85k  4950884.35k

⋊> ~ openssl speed -decrypt -elapsed -evp aes-128-ccm                                                                                                                                 12:07:32
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-128-ccm for 3s on 16 size blocks: 235354888 aes-128-ccm's in 3.00s
Doing aes-128-ccm for 3s on 64 size blocks: 234594124 aes-128-ccm's in 3.00s
Doing aes-128-ccm for 3s on 256 size blocks: 236230823 aes-128-ccm's in 3.00s
Doing aes-128-ccm for 3s on 1024 size blocks: 235920946 aes-128-ccm's in 3.00s
Doing aes-128-ccm for 3s on 8192 size blocks: 236134945 aes-128-ccm's in 3.00s
Doing aes-128-ccm for 3s on 16384 size blocks: 236273795 aes-128-ccm's in 3.00s
OpenSSL 1.1.1-dev  xx XXX xxxx
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(int) aes(partial) idea(int) blowfish(ptr) 
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR="\"/usr/local/ssl\"" -DENGINESDIR="\"/usr/local/lib/engines-1.1\""  -Wa,--noexecstack
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-128-ccm    1255226.07k  5004674.65k 20158363.56k 80527682.90k 644805823.15k 1290369952.43k

Answer 1

你要知道安全性是和速度成反比的，加解密速度越快越容易被破解