Whenever I get my hands on a new device or machine, one of the first things I do is run openssl speed -evp <cipher> and log the throughput for 16k blocks, specifically from AES-256-GCM and ChaCha20-Poly1305 ciphers. These ciphers are widely used for VPNs and TLS, and both ciphers benefit from dedicated instructions and accelerated units present on modern CPUs: AES have dedicated instructions for performing rounds (AES-NI), while ChaCha20 benefits from SIMD with vector operations (AVX2, Neon). High throughput from modern CPUs regardless of clock speed immediately reflect this.

All these efforts started from me trying to find a cheap VM where I could run my self-hosted stuff. There are a lot of cloud providers with Linux VMs using different CPUs at multiple price points. I wanted to do quick tests and compare them to something I could run on my own machines, putting into consideration how much value the cloud VMs give me compared to just hosting them at home. These quick tests turned into a habit: any device I ha, or I can borrow that has OpenSSL would have me running openssl speed on the terminal.

Things get a bit trickier for non-Linux devices, but the tests can still be done with low effort. For Windows, OpenSSL comes from either an installation of Git or through WSL. In Macs, the OpenSSL which have these ciphers come from Homebrew, and from my experience people who usually install Homebrew used it for installing something that would depend on OpenSSL as well. The weird one is with Android, which can be done by installing Termux APK. Rarely do people have this on their phones, so you have to make sure they’re okay with installing an APK.

I have to emphasize that the results here are imprecise and can only be taken at face value. Unaccounted variables include thermal and power constraints, server tenancy (for cloud VMs), background processes, OpenSSL version and build flags, etc. Putting effort into accounting these would make the testing scheme less opportunistic. My rule of thumb is that I have to be able to do all these on a device I borrowed for under 3 minutes without installing anything new.

So here’s my record of me running OpenSSL speed on as many devices that I can have my hands on:

Device NameDevice TypeDetails (OS, etc.)AES-256-GCM @ 16kChacha20-Poly1305 @ 16k
GCP e2-micro (2C1G) asia-east2VM - CloudUbuntu, Skylake (w/ AVX512)2.997 GB/s2.041 GB/s
GCP e2-micro (2C1G) asia-east1VM - CloudUbuntu, Haswell2.984 GB/s1.415 GB/s
GCP f1-micro(1C1G) us-west1VM - CloudUbuntu, Skylake, free-tier zone0.594 GB/s0.387 GB/s
GCP n2-standard-2 (2C8G) asia-southeast1VM - CloudUbuntu, Ice Lake5.462 GB/s3.878 GB/s
GCP c3-highcpu-4 (4C8G) us-central1-aVM - CloudUbuntu, Sapphire Rapids (No QAT)4.843 GB/s3.545 GB/s
AWS Lightsail (1C2G) asia-southeast-1VM - CloudUbuntu, Haswell2.005 GB/s1.373 GB/s
AWS t4g-micro (2C1G) asia-east-1VM - CloudUbuntu, ARM N1, Graviton22.014 GB/s0.686 GB/s
AWS c7g-medium (1C2G) us-west-1VM - CloudUbuntu, ARM V1, Graviton33.944 GB/s1.093 GB/s
Ampere Altra (1C4G)VM - CloudUbuntu, ARM N1, Altra2.401 GB/s0.874 GB/s
DigitalOcean (1C1G) sg1VM - CloudUbuntu, Cascade Lake (w/ AVX512)3.430 GB/s2.002 GB/s
DigitalOcean (1C1G) sg1VM - CloudUbuntu, Zen2 (Rome)2.804 GB/s1.476 GB/s
Intel Core i7-2600VM - LocalUbuntu on Proxmox, Sandy Bridge1.235 GB/s0.939 GB/s
Intel Core i3-7100ULaptopClear Linux, Kaby Lake2.694 GB/s1.425 GB/s
Laptop, MacBook AirLaptopmacOS, ARM M1, OpenSSL from Brew5.952 GB/s1.835 GB/s
Laptop, MacBook Pro i7-8750HLaptopmacOS, Intel, OpenSSL from Brew4.391 GB/s2.362 GB/s
Laptop, MacBook Air 2017 i5-5350ULaptopmacOS, Intel, OpenSSL from Brew2.756 GB/s1.531 GB/s
AMD Ryzen 5 2600XDesktopWindows 11 - WSL2, Zen+4.324 GB/s1.207 GB/s
AMD Threadripper TR 2950XDesktopWindows 11 - Host (from Git), Zen+4.568 GB/s1.281 GB/s
Desktop, i7-8700DesktopUbuntu, Coffee Lake5.121 GB/s2.728 GB/s
Desktop, Mac Mini i5-4278UDesktopmacOS, Intel (late 2014)2.348 GB/s1.655 GB/s
Desktop, iMac i5-2400SDesktopmacOS, Intel (mid 2011)1.111 GB/s0.822 GB/s
MediaTek MT7621RouterOpenWRT, Mi Router 4A-G0.005 GB/s0.019 GB/s
Broadcom BCM4906RouterAsusWRT-Merlin, RT-AC86U0.608 GB/s0.270 GB/s
Phone, Exynos 2100PhoneAndroid 12, S21 Ultra2.421 GB/s1.115 GB/s
Tablet, Helio A22PhoneAndroid 10, Lenovo Tab M80.838 GB/s0.334 GB/s
Intel Atom x5-Z8350ServerClear Linux0.226 GB/s0.188 GB/s
Intel Core2Duo E6750ServerUbuntu, LGA775-era0.067 GB/s0.392 GB/s
Raspberry Pi 3BSBC/ServerUbuntu aarch640.023 GB/s0.098 GB/s
NVIDIA Jetson NanoSBC/ServerUbuntu aarch64 A570.738 GB/s0.265 GB/s
Intel Xeon E5-2620v4ServerUbuntu, Broadwell2.427 GB/s1.375 GB/s
Intel Core i7-4790ServerUbuntu, Haswell2.985 GB/s2.030 GB/s
AMD EPYC 7282ServerUbuntu, Zen2 (Rome)3.462 GB/s1.748 GB/s
Intel Xeon E5405ServerUbuntu, Penryn0.079 GB/s0.337 GB/s

Note: I will add more entries and observations as I get more devices which I can run the tests with. I might have to restructure the columns as well. The active document can be found here.

Some observations:

  • The CPU generation matters a lot: the increase in throughput for both ciphers shows up as SIMD lanes get wider and instruction sets get more advanced. For cloud providers, you have to make sure that the price point they offer the VMs with are in line with what generation of CPU is used.
  • Expect the throughput of server CPUs to be slower than their desktop and laptop counterparts, despite belonging to the same generation. Servers don’t have aggressive clock boosting that desktops or even phones have.
  • The Apple M1 had the highest discrepancy between measured throughputs. While undoubtably M1 is the most advanced processor we had in 2020 as shown by having the best AES performance, it had moderate SIMD performance gains shown by ChaCha.
  • On the other hand, very old CPUs tend to have better Chacha performance than AES. This is the whole point of having Chacha20-Poly1305 as the cipher for Wireguard: old devices and phones can still get decent VPN throughput despite the lack of dedicated AES units.

With all the information above, what did I end up using to host my stuff online? So far I have GCP’s e2-micro at asia-east-2 winning in terms of value. Before comparing performance results, I had to consider the latency and price: I think 15 USD is too much to pay for anything monthly, and the ping has to be sub-30 ms from home (latency-wise, it’s HK>TW>SG regardless of ISP here). While e2-micro at asia-east-1 also fits the bill, you are more likely to get E2 instances that are Skylake or later in HK. Who knows, this might change as CPU offerings get more modern and pricing become more competitive.