From owner-freebsd-hackers@FreeBSD.ORG Fri Sep 12 00:45:44 2014 Return-Path: Delivered-To: hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id D6C60CE4 for ; Fri, 12 Sep 2014 00:45:44 +0000 (UTC) Received: from h2.funkthat.com (gate2.funkthat.com [208.87.223.18]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "funkthat.com", Issuer "funkthat.com" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id B4575CE9 for ; Fri, 12 Sep 2014 00:45:44 +0000 (UTC) Received: from h2.funkthat.com (localhost [127.0.0.1]) by h2.funkthat.com (8.14.3/8.14.3) with ESMTP id s8C0jgPH062909 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 11 Sep 2014 17:45:43 -0700 (PDT) (envelope-from jmg@h2.funkthat.com) Received: (from jmg@localhost) by h2.funkthat.com (8.14.3/8.14.3/Submit) id s8C0jfHd062908; Thu, 11 Sep 2014 17:45:41 -0700 (PDT) (envelope-from jmg) Date: Thu, 11 Sep 2014 17:45:41 -0700 From: John-Mark Gurney To: Wojciech Puchar Subject: Re: openssl with aes-in or padlock Message-ID: <20140912004541.GQ82175@funkthat.com> Mail-Followup-To: Wojciech Puchar , hackers@freebsd.org References: <20140911180258.GN82175@funkthat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.3i X-Operating-System: FreeBSD 7.2-RELEASE i386 X-PGP-Fingerprint: 54BA 873B 6515 3F10 9E88 9322 9CB1 8F74 6D3F A396 X-Files: The truth is out there X-URL: http://resnet.uoregon.edu/~gurney_j/ X-Resume: http://resnet.uoregon.edu/~gurney_j/resume.html X-TipJar: bitcoin:13Qmb6AeTgQecazTWph4XasEsP7nGRbAPE X-to-the-FBI-CIA-and-NSA: HI! HOW YA DOIN? can i haz chizburger? X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.2.2 (h2.funkthat.com [127.0.0.1]); Thu, 11 Sep 2014 17:45:43 -0700 (PDT) Cc: hackers@freebsd.org X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Sep 2014 00:45:45 -0000 Wojciech Puchar wrote this message on Thu, Sep 11, 2014 at 23:33 +0200: > >>#openssl speed -evp aes-256-cbc > > > >First off, you won't get much speed up w/ CBC encrypt... Try testing > >using aes-256-ctr instead... CBC can't process multiple blocks in > >parallel like CTR can... if you measure the cbc _decrypt_ speed, you > >should see a big improvement as CBC decrypt can be parallelized... > > > >>in the same time dd from geli encrypted ramdisk to /dev/null is 66MB/s > > > >geli uses a different framework for it's crypto processing.. for geli, > >make sure you have the aesni kernel module loaded before you attach > >to a geli disk... You should get kernel messages like the following: > >GEOM_ELI: Device gpt/werner.eli created. > >GEOM_ELI: Encryption: AES-XTS 256 > >GEOM_ELI: Crypto: hardware > > yes i have this. contrary to what you say - both AES-XTC and AES-CBC gets > MUCH faster with AES-NI. Well, AES-NI CBC may be faster w/ AES-NI, but it's not as fast as using another mode... AES-XTS should be many times faster than CBC... Also, above you compared two different modes... on CBC encrypt (the OpenSSL test) and CBC decrypt (the geli test) so of course you're going to get very different performances... You didn't tell me if you're using a new enough version of OpenSSL or not.. What release are you using? iirc, 10.0-R was the first release that the included OpenSSL suppoed AES-NI... You can always install OpenSSL from ports to get a version that supports AES-NI... > >notice the Crypto: hardware line.. Also, make sure that your geli > >sector size is 4k instead of 512... This reduces the loop overhead, > > as i already said - geli works fast and make use of AES-NI or padlock > > openssl does not For comparision: $ openssl speed -evp aes-256-cbc [...] type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-256-cbc 348326.67k 408978.79k 431361.86k 456647.06k 460708.89k $ openssl speed -decrypt -evp aes-256-cbc [...] type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-256-cbc 318017.94k 1263192.77k 2938389.38k 3288584.50k 3400531.97k notice, encrypt is 460MB/sec vs 3.4GB/sec decrypt... This is HEAD: $ openssl version OpenSSL 1.0.1h-freebsd 5 Jun 2014 Also, 66MB/sec seems VERY slow to me to be using AES-NI, but it just could be you're on 9.x which didn't have very good AES-NI kernel support... We need more information about which version of FreeBSD, and what processor you have before we can be more help... The first part of dmesg would be useful... and also openssl version too.. -- John-Mark Gurney Voice: +1 415 225 5579 "All that I will do, has been done, All that I have, has not."