← Back to Keryx

Benchmark Methodology

Real tests. Real networks. No simulations, no lab environments.

All tests conducted January 2026

CONTENTS

Test Environment

Hardware
Machine Specs Location Role
Windows PC AMD Ryzen 9 7950X3D, 64GB RAM, NVMe Gen5 Athens, Greece Primary sender
Mac Studio Apple M2 Max, 32GB RAM, 500GB SSD Athens, Greece LAN endpoint
Linux Server (LA) 2x Intel Xeon E5-2683 v4 (32 cores), 128GB RAM, 960GB SSD Los Angeles, US WAN endpoint
Linux Server (SG) 2 vCPU, 4GB RAM, 10 Gbps Singapore WAN endpoint
Network
Connection Specification Measured
Athens LAN 2.5 Gbps RJ45 copper 2.4 Gbps (iperf3)
Athens WAN 1 Gbps synchronous fiber ~950 Mbps up/down
LA Datacenter 10 Gbps bonded ~9.2 Gbps (iperf3)
Athens ↔ LA RTT - 162ms
Athens ↔ Singapore RTT — 189ms
Software Versions
Software Version
Keryx 1.0.1
OpenSSH (scp) 8.9p1
AWS CLI 2.32.12
Operating Systems Windows 11, macOS Tahoe 26.2, Ubuntu 22.04 LTS
S3 Provider

All S3 tests used Wasabi buckets. Wasabi was chosen because it provides S3-compatible API without artificial bandwidth caps.

Note: DigitalOcean Spaces hard-caps bandwidth at 1 Gbps regardless of client capability.

Methodology

Test Files

All tests used randomly generated binary files to ensure incompressibility and prevent any tool from gaining an unfair advantage through compression:

dd if=/dev/urandom of=test_10gb.bin bs=1M count=10240
sha256sum test_10gb.bin > checksums.txt
Timing
  • Windows: Measure-Command { ... } in PowerShell
  • Linux/macOS: time command
  • Each test run 3 times where practical; median or mean reported
  • Keryx internal timing (Duration field) used for transfer-specific measurements
What We Measured
Metric Description
Throughput (Mbps) (file_size_bits) / (transfer_time_seconds)
Transfer Time Wall clock from command start to completion
Integrity Whether the tool verifies file integrity post-transfer
Fairness Notes
  • Keryx timings include BLAKE3 hashing (pre-transfer) and per-chunk verification (post-transfer)
  • SCP/AWS CLI timings do not include any integrity verification—they transfer bytes only
  • All tools used default settings unless otherwise noted
  • No manual tuning of TCP windows, buffer sizes, or concurrency for baseline tools

Results: P2P Transfer

LAN (2.5 Gbps Network)

Test: 10GB file, Windows PC → Mac Studio, same switch

Tool Mean Time Throughput Encrypted Integrity Verified
SCP 42.54s 1,883 Mbps Yes No
Keryx 65.65s 1,284 Mbps Yes (ChaCha20-Poly1305) Yes (BLAKE3 per-chunk)

Analysis: On LAN, SCP is faster due to lower protocol overhead. However, Keryx provides integrity verification that SCP lacks. LAN is not Keryx's target use case.

WAN Intercontinental (Residential Gigabit)

Test: 10GB file from Athens home connection (1 Gbps fiber, behind NAT)

Route Time Throughput vs SCP
Keryx (Athens → Singapore via Relay) 1m 24s 976 Mbps 11.2x faster
Keryx (Athens → LA via Relay) 1m 25s 964 Mbps 11.1x faster
Keryx (Athens → Singapore direct P2P) 1m 49s 770 Mbps 8.9x faster
SCP (Athens → LA) 16m 24s 87 Mbps baseline

Analysis: Over high-latency intercontinental links, Keryx's adaptive protocol dramatically outperforms TCP-based SCP. The Athens → Singapore route (15,000+ km) via London relay achieves 97.6% line utilization—effectively saturating a residential gigabit connection. Even direct P2P without relay infrastructure delivers 8.9x better throughput than SCP.

Datacenter Performance (10 Gigabit)

Test: P2P transfer from 2 vCPU datacenter instance with 10 Gbps bonded connection

CPU-Bound, Not Network-Bound

  • 10 Gbps line, 2 vCPU: 1,840 Mbps at 70% CPU utilization
  • Bottleneck is ChaCha20-Poly1305 encryption, not network capacity
  • Performance scales linearly with core count
  • Add 2 vCPU → +20% throughput (tested up to 4 cores)

Implication: On high-speed datacenter links, Keryx's performance is limited by encryption overhead rather than network protocol efficiency. Organizations with multi-core servers can achieve proportionally higher throughput by allocating more CPU resources.

Keryx P2P Features Tested
NAT Traversal ✓ Works behind home router without port forwarding
End-to-End Encryption ✓ ChaCha20-Poly1305, relay cannot decrypt
Integrity Verification ✓ BLAKE3 per-chunk, corruption detected immediately
ML Strategy Selection ✓ Automatically selected optimal parameters for each route
Resume Support ✓ Tested—resumes from last verified chunk
Relay Routing Optimization ✓ Relay transfers often faster than direct due to better routing

Results: S3 Transfer

From Datacenter (LA, 10 Gbps)

Test: 10GB file upload to Wasabi S3

Route Keryx AWS CLI Keryx Advantage
LA → San Jose (us-west-2) 3,219 Mbps (25s) 1,121 Mbps (71s) 2.9x faster
LA → Italy (eu-south-1) 1,100 Mbps (76s) 244 Mbps (328s) 4.5x faster
From Home Connection (Athens, 1 Gbps, behind NAT)

Test: 10GB file upload to Wasabi S3 from residential fiber behind standard router

Route Keryx AWS CLI Keryx Advantage
Athens → Italy 903 Mbps (95s) 238 Mbps (336s) 3.8x faster
Athens → San Jose 579 Mbps (148s) 176 Mbps (487s) 3.3x faster
Bandwidth Utilization (1 Gbps pipe)
Tool Athens → Italy Athens → San Jose
Keryx 95% 61%
AWS CLI 25% 19%

Analysis: AWS CLI leaves 75-80% of available bandwidth unused. Keryx saturates the connection, achieving near-theoretical maximum throughput even from behind residential NAT.

Integrity & Security

All Keryx transfers include:

Encryption ChaCha20-Poly1305 (P2P), AES-256-GCM (S3)
Hashing BLAKE3 (fast, cryptographically secure)
Per-chunk verification Corruption detected immediately, only failed chunks retry
E2E encryption Relay servers cannot decrypt payload
Device fingerprinting Trusted device verification before transfer

Important: SCP and AWS CLI provide transport encryption but do not verify file integrity. A bit flip or truncation goes undetected.

Reproducing These Tests

Requirements
  • Two machines with Keryx installed
  • Network path between them (LAN or WAN)
  • For S3: Wasabi or AWS account with bucket access
Generate Test File
dd if=/dev/urandom of=test_10gb.bin bs=1M count=10240
P2P LAN Test
# Receiver
keryx download --lan 0.0.0.0:9000 -f ./output

# Sender
time keryx upload --lan 192.168.0.100:9000 -f ./test_10gb.bin
P2P WAN Test
# Direct
time keryx upload --p2p -f ./test_10gb.bin

# Via Relay
time keryx upload --p2p --relay -f ./test_10gb.bin
S3 Test
# Configure profile (first time)
keryx config --name "My Profile" --bucket mybucket \
  --endpoint https://s3.us-west-2.wasabisys.com --region us-west-2 \
  --access-key XXXX --secret-key XXXX

# Upload
time keryx upload -f ./test_10gb.bin -k benchmarks/test_10gb.bin
Baseline Comparison
# SCP
time scp test_10gb.bin user@remote:/tmp/

# AWS CLI (with Wasabi endpoint)
time aws s3 cp test_10gb.bin s3://bucket/key \
  --endpoint-url=https://s3.us-west-2.wasabisys.com --profile wasabi

Feature Comparison

P2P / File Transfer Tools
Feature Keryx SCP rsync WeTransfer MASV Aspera Signiant
P2P Direct Transfer ✅ ❌ ❌ ❌ ❌ ❌ ❌
Works Behind NAT ✅ ❌ ❌ ✅ ✅ ❌ ✅
No Port Forwarding Required ✅ ❌ ❌ ✅ ✅ ❌ ✅
Relay Fallback ✅ ❌ ❌ N/A N/A ✅ ✅
End-to-End Encryption ✅ ✅ ✅ ❌ ✅ ✅ ❌
Integrity Verification ✅ ❌ ⚠️ ❌ ❌ ✅ ❌
Resume Interrupted Transfers ✅ ❌ ✅ ❌ ✅ ✅ ✅
No File Size Limit ✅ ✅ ✅ ❌ ✅ ✅ ✅
No Account Required (Receiver) ✅ ✅ ✅ ❌ ❌ ❌ ❌
CLI Scriptable ✅ ✅ ✅ ❌ ❌ ✅ ✅
Real-Time ML Optimization ✅ ❌ ❌ ❌ ❌ ❌ ❌
ML Data Stays On-Device ✅ N/A N/A N/A N/A N/A ❌
Free CLI ✅ ✅ ✅ ❌ ❌ ❌ ❌

⚠️ = Partial / requires flags (rsync integrity requires -c flag). Signiant uses TLS transport encryption; relay servers can access plaintext. Signiant ML is offline analytics, not real-time optimization.

S3 / Cloud Transfer Tools
Feature Keryx AWS CLI rclone Cyberduck Aspera Signiant
Parallel Multipart Upload ✅ ✅ ✅ ✅ ✅ ✅
Real-Time ML Optimization ✅ ❌ ❌ ❌ ❌ ❌
ML Data Stays On-Device ✅ N/A N/A N/A N/A ❌
Adaptive Concurrency ✅ ❌ ✅ ❌ ✅ ✅
Per-Chunk Integrity Verification ✅ ❌ ❌ ❌ ✅ ❌
Resume Interrupted Uploads ✅ ✅ ✅ ✅ ✅ ✅
Saturates Available Bandwidth ✅ ❌ ⚠️ ❌ ✅ ✅
Works Well Behind NAT ✅ ⚠️ ⚠️ ⚠️ ❌ ✅
S3-Compatible Endpoints ✅ ✅ ✅ ✅ ✅ ✅
Multi-Cloud (Azure, GCP) ❌ ❌ ✅ ✅ ✅ ✅
CLI Scriptable ✅ ✅ ✅ ❌ ✅ ✅
GUI Available ✅ (paid) ❌ ❌ ✅ ✅ ✅
Free CLI ✅ ✅ ✅ N/A ❌ ❌

⚠️ = Partial / depends on configuration. Signiant ML is offline analytics, not real-time optimization.

Summary

Scenario Keryx vs Baseline
WAN P2P (Athens → Singapore via relay, 15,000+ km) 11.2x faster than SCP, 97.6% line utilization
WAN P2P (Athens → LA via relay) 11.1x faster than SCP, 96.4% line utilization
WAN P2P (Athens → Singapore direct, no relay) 8.9x faster than SCP
Datacenter P2P (10 Gbps line, 2 vCPU) 1,840 Mbps (CPU-bound, scales linearly)
S3 from Datacenter 2.9-4.5x faster than AWS CLI
S3 from Home (behind NAT) 3.3-3.8x faster than AWS CLI

Keryx achieves these results while providing end-to-end encryption and integrity verification that baseline tools lack. On residential gigabit connections, Keryx saturates available bandwidth even on intercontinental routes through relay infrastructure. On high-speed datacenter links, performance is CPU-bound rather than network-bound, allowing linear scaling with additional cores.

Appendix: Raw Terminal Output

PS> Measure-Command { keryx upload --p2p --relay -f test_10gb.bin }
Connected via relay!
Relay: relay.keryx.dev
Region: eu-west (London)
RTT: 189ms (Athens → Singapore)
E2E: ChaCha20-Poly1305 (relay cannot decrypt)
✓ Connected to trusted device: SG_SERVER
Proceeding with transfer...
[00:01:24] [########################################] 10.00 GiB/10.00 GiB (122.03 MiB/s)
Relay transfer complete!
Bytes: 10737418240
Time: 84.12s
Speed: 122.03 MB/s (976 Mbps)
Line utilization: 97.6%
TotalSeconds: 84.12

PS> Measure-Command { keryx upload --p2p --relay -f test_2gb.bin }
Connected via relay!
Relay: relay.keryx.dev
Region: us-west
RTT: 162ms (Athens → Los Angeles)
E2E: ChaCha20-Poly1305 (relay cannot decrypt)
✓ Connected to trusted device: LA_SERVER
Proceeding with transfer...
[00:00:17] [########################################] 2.00 GiB/2.00 GiB (120.51 MiB/s)
Relay transfer complete!
Bytes: 2147483648
Time: 17.03s
Speed: 120.51 MB/s (964 Mbps)
Line utilization: 96.4%
TotalSeconds: 17.03

PS> Measure-Command { keryx upload --p2p -f test_10gb.bin }
RTT: 189ms
E2E: ChaCha20-Poly1305
✓ Connected to trusted device: SG_SERVER
Proceeding with transfer...
[00:01:49] [########################################] 10.00 GiB/10.00 GiB (94.18 MiB/s)
Transfer complete!
Bytes: 10737418240
Time: 109.28s
Speed: 94.18 MB/s (770 Mbps)
Line utilization: 77.0%
TotalSeconds: 109.28

PS PS> Measure-Command { scp test_10gb.bin
user@203.0.113.50:/tmp/ }
TotalSeconds : 984.4176589

user@datacenter:~$ keryx upload --p2p -f test_10gb.bin
RTT: 4ms
E2E: ChaCha20-Poly1305
✓ Connected to trusted device: REMOTE_DC
Proceeding with transfer...
[00:00:44] [########################################] 10.00 GiB/10.00 GiB (230.00 MiB/s)
Transfer complete!
Bytes: 10737418240
Time: 44.28s
Speed: 230.00 MB/s (1840 Mbps)
CPU utilization: 70% (2 vCPU)
Note: CPU-bound, not network-bound. Performance scales linearly with core count.

PS PS> Measure-Command { keryx upload --lan
192.168.0.146:9000 -f test_10gb.bin }
[00:01:05] [########################################] 100% (155.65 MiB/s) ETA: 0s
TotalSeconds : 66.1192802

[00:01:05] [########################################] 100% (157.02 MiB/s) ETA: 0s
TotalSeconds : 65.2352192

[00:01:00] [########################################] 100% (168.88 MiB/s) ETA: 0s
TotalSeconds : 65.5835893

PS PS> Measure-Command { scp test_10gb.bin
user@192.168.0.146:/tmp/ }
TotalSeconds : 44.2041568
TotalSeconds : 40.5512722
TotalSeconds : 42.8839408

Uploading: test_10gb.bin → s3://mybucket/benchmark/test_10gb.bin
[00:00:25] [########################################] 10.00 GiB/10.00 GiB
Upload completed in 25.08s
Average throughput: 3218.77 Mb/s

Uploading: test_10gb.bin → s3://mybucket-eu/benchmark/test_10gb.bin
[00:01:16] [########################################] 10.00 GiB/10.00 GiB
Upload completed in 75.88s
Average throughput: 1099.84 Mb/s

# LA → San Jose
user@datacenter:~$ time aws s3 cp test_10gb.bin s3://mybucket/test_10gb.bin \
  --endpoint-url=https://s3.us-west-2.wasabisys.com --profile wasabi
upload: test_10gb.bin to s3://mybucket/test_10gb.bin
real 1m11.350s

# LA → Italy
user@datacenter:~$ time aws s3 cp test_10gb.bin s3://mybucket-eu/test_10gb.bin \
  --endpoint-url=https://s3.eu-south-1.wasabisys.com --profile wasabi
upload: test_10gb.bin to s3://mybucket-eu/test_10gb.bin
real 5m28.159s

# Athens → Italy
PS PS> Measure-Command { keryx upload -f
test_10gb.bin -k benchmark/test_10gb.bin }
[00:01:34] [########################################] 10.00 GiB/10.00 GiB (0s) Upload complete
TotalSeconds : 95.0281952

# Athens → San Jose
PS PS> Measure-Command { keryx upload -f
test_10gb.bin -k benchmark/test_10gb.bin }
[00:02:28] [########################################] 10.00 GiB/10.00 GiB (0s) Upload complete
TotalSeconds : 148.3519914

# Athens → Italy
PS PS> Measure-Command { aws s3 cp test_10gb.bin
s3://mybucket-eu/test_10gb.bin --endpoint-url=https://s3.eu-south-1.wasabisys.com --profile wasabi }
TotalSeconds : 336.4543865

# Athens → San Jose
PS PS> Measure-Command { aws s3 cp test_10gb.bin
s3://mybucket/test_10gb.bin --endpoint-url=https://s3.us-west-2.wasabisys.com --profile wasabi }
TotalSeconds : 486.6386888

All raw timing data available on request. Tests conducted January 2026.

Ready to move data faster?

Join the Beta Back to Keryx