I have an application idea that would require calling ssh-agent rather frequently - but how many requests per second can it handle?

To answer this question I wrote a small benchmark in Go. It runs a tight loop sending messages for ssh-agent to sign. Turns out the agent is pretty fast!

On a cheap cloud machine it was able to reliably sign more than 500 messages per second with an ED25519 key. RSA signing was about 4-5 times slower, as expected. For a personal heuristic I've decided to memorize that ED25519 signatures cost 2ms and RSA ones 8ms.

Message size had little effect on throughput because both in ED25519 and in RSA signatures inputs are hashed with a fast SHA algorithm prior to any other processing.

Just in case my random number generator was too slow I checked if it affects the benchmark results. Tests confirmed that it doesn't.

Of course, 500 rps does not sound web scale but for me it's more than enough. OpenSSH ssh-agent utilizes only a single CPU core, so there is some potential for performance improvement if you need - but that would mean doing the signatures in your software. I would rather trust OpenSSH team (who are known to be just the right amount of paranoid) than touch private key material with my clumsy hands.

You can run the same tests yourself: clone the repo and execute make from top-level directory. Benchmark names describe the key being used, message size and whether the message is unique or the same for each iteration. Here is a sample output:

BenchmarkSshAgent/key_ed25519/32B/unique-4          3553      1763363 ns/op
BenchmarkSshAgent/key_ed25519/32B/same-4            3568      1708270 ns/op
BenchmarkSshAgent/key_rsa4096/32B/unique-4           778      7824780 ns/op
BenchmarkSshAgent/key_rsa4096/32B/same-4             763      7657785 ns/op
BenchmarkSshAgent/key_ed25519/64B/unique-4          3456      1752457 ns/op
BenchmarkSshAgent/key_ed25519/64B/same-4            3598      1733750 ns/op
BenchmarkSshAgent/key_rsa4096/64B/unique-4           781      7639828 ns/op
BenchmarkSshAgent/key_rsa4096/64B/same-4             798      7720210 ns/op
BenchmarkSshAgent/key_ed25519/256B/unique-4         3549      1735906 ns/op
BenchmarkSshAgent/key_ed25519/256B/same-4           3417      1722301 ns/op
BenchmarkSshAgent/key_rsa4096/256B/unique-4          698      7738767 ns/op
BenchmarkSshAgent/key_rsa4096/256B/same-4            787      7625366 ns/op
BenchmarkSshAgent/key_ed25519/1024B/unique-4        3555      1703601 ns/op
BenchmarkSshAgent/key_ed25519/1024B/same-4          3651      1633226 ns/op
BenchmarkSshAgent/key_rsa4096/1024B/unique-4         805      7542115 ns/op
BenchmarkSshAgent/key_rsa4096/1024B/same-4           810      7437307 ns/op
BenchmarkSshAgent/key_ed25519/16384B/unique-4       3205      1935190 ns/op
BenchmarkSshAgent/key_ed25519/16384B/same-4         3296      1907921 ns/op
BenchmarkSshAgent/key_rsa4096/16384B/unique-4        783      7624776 ns/op
BenchmarkSshAgent/key_rsa4096/16384B/same-4          759      7620548 ns/op