recommend AES-256-CBC as a good option. AES is a fast algorithm, the 256-bit key size is long enough to be secure against attacks for a good few years and it is small enough to be fast. CBC designates the algorithm used to apply the AES to a data stream (remember, AES is a block cipher and only processes discrete blocks of information). Don't use the ECB block mode - this just isn't very strong in situations such as backups where the blocks of data at the start of the unencrypted stream are fairly predictable. You should avoid plain DES because it has a relatively short 56-bit key length, triple-DES is suitable for using in backups but it is quite slow as will be shown in the next section. Performance Of course, you don't get anything for free. Encrypting large volumes of data can have quite a high impact on CPU usage depending on which algorithm you use, and performance impacts can be one of the major issues preventing companies from implementing encryption. I performed some basic tests with OpenSSL using a number of ciphers to encrypt 8 gigabytes of data on a 1.0GHz Intel server with the output just going to /dev/null. The encryption time given in the following chart. From these results, you cen see that triple-DES is really quite slow, and that AES-128 and AES-256 perform very well in comparison. It can be hard to predict just how much effect encryption will have on a system. If the