How to Benchmark Cryptographic Performance in Linux Terminal Using openssl speed

Whether evaluating new cloud server instances, testing CPU hardware acceleration extensions (such as Intel AES-NI or ARMv8 Cryptography Extensions), or optimising web server TLS handshake performance, measuring raw cryptographic throughput is essential for systems administrators. Rather than installing heavy external benchmarking suites, the built-in openssl speed command provides an authoritative, lightweight, and precise benchmark for symmetric ciphers, cryptographic hashes, and asymmetric key algorithms directly from the Linux shell.

Understanding the openssl speed Command

The openssl speed utility evaluates the processing speed of cryptographic algorithms by performing a standard sequence of encryption, hashing, and signature operations over defined time intervals (typically 3 seconds per block size). It tests varying block chunk sizes (16, 64, 256, 1024, 8192, and 16384 bytes) and outputs throughput measured in bytes processed per second or sign/verify operations per second.

Running Basic Cryptographic Benchmarks

If executed without arguments, openssl speed runs an exhaustive benchmark across every compiled cipher and digest in OpenSSL, which can take upwards of 15 to 30 minutes. To save time, target specific modern algorithms commonly used in HTTPS, SSH, and VPN connections:

Benchmarking Symmetric Ciphers (AES-GCM and ChaCha20)

To benchmark AES-256 with Galois/Counter Mode (GCM) and ChaCha20-Poly1305:

# Benchmark AES-256-GCM
openssl speed -evp aes-256-gcm

# Benchmark ChaCha20-Poly1305
openssl speed -evp chacha20-poly1305

Note: Always include the -evp flag when benchmarking ciphers on modern Linux systems. The EVP (Envelope) interface engages kernel and CPU hardware acceleration instructions (such as AES-NI or ARM CE). Benchmarking without -evp tests fallback software implementations rather than real-world hardware capabilities.

Benchmarking Cryptographic Hashing Algorithms

To evaluate hashing throughput for data integrity checks and blockchain protocols:

# Benchmark SHA-256
openssl speed -evp sha256

# Benchmark SHA-512
openssl speed -evp sha512

Benchmarking Asymmetric Ciphers (RSA and ECDSA)

To evaluate TLS handshake performance, test asymmetric key operations to measure how many digital signatures and verification checks your CPU can complete each second:

# Benchmark RSA with standard 2048-bit and 4096-bit keys
openssl speed rsa2048 rsa4096

# Benchmark Elliptic Curve Cryptography (ECDSA NIST P-256)
openssl speed ecdsap256

Running Multi-Threaded Benchmarks Across All CPU Cores

By default, openssl speed runs single-threaded on a single CPU core. On multi-core servers, evaluating aggregate cryptographic capacity requires enabling parallel worker threads with the -multi parameter:

# Run AES-256-GCM across 4 CPU cores
openssl speed -multi 4 -evp aes-256-gcm

# Automatically match multi-threading to total system core count
openssl speed -multi $(nproc) -evp aes-256-gcm

Interpreting Benchmark Output

The terminal outputs a clean tabular summary upon completion. For symmetric ciphers and hashes, the columns reflect block sizes:

type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-256-gcm     1245000k     3450000k     6780000k     8920000k     9450000k     9520000k

Values followed by k represent kilobytes per second (e.g. 9520000k equates to roughly 9.52 GB/s of AES encryption throughput). Notice that larger block sizes (such as 8 KB or 16 KB) achieve significantly higher throughput because fixed per-call CPU overhead is amortised over larger payloads.

For RSA and ECDSA tests, the results display:

• sign/s: The number of private key signing operations completed per second.
• verify/s: The number of public key verification checks completed per second.

Validating Hardware Acceleration Support

If your AES-GCM benchmark results appear unexpectedly low (under 1 GB/s on modern hardware), verify whether hardware cryptographic instructions are enabled in your Linux kernel:

# On x86_64 systems, verify AES-NI flag
lscpu | grep -i aes

# On ARM64 systems, verify Cryptography Extension
lscpu | grep -i aes

If the aes flag is missing inside virtual machines or cloud VPS instances, inspect your hypervisor CPU passthrough settings to ensure hardware features are exposed to the guest operating system.