SSH Cipher in Procurve

[jhonfersg]

Hi, I'm setting up SSH on ProCurve switch and asks me if encryption is CBC or CTR.

What is the best setting?

Thanks.

[Anonymous]

Hello John,

CTR mode should be preferred over CBC mode, whenever possible. It can be executed in parallel, and it seems to be the "safer" choice over CBC although it's security margin over CBC is probably minimal. The internal mechanisms are more simplistic, which is why modes like EAX and GCM use CTR internally. With that said, CBC mode is not "unsafe", so there is no strong security argument to avoid it. However, modern and older OpenSSH implementations support CTR mode, so there really is no need for CBC.

Thanks and regards

Anurag Thottathil