5

I have a HW-accelerated AES processor. With that in mind, my first question would be:

Do AES-NI instructions accelerate both AES-128 and AES-256 encryption / decryption?

Secondly, if it is true, that these CPUs accelerate both lengths, why would some VPN providers recommend AES-128 for speed?

4

Yes, AES-NI accelerates both AES-128 and AES-256, and yes, there is a performance difference between hardware accelerated AES-128 and AES-256, according to https://software.intel.com/en-us/articles/intel-aes-ni-performance-enhancements-hytrust-datacontrol-case-study#_Toc397546813:

On Ivy Bridge here are the raw numbers for both Cyber-Block-Chaining (CBC) and XEX-based tweaked-codebook mode with ciphertext stealing (XTS) modes with both 128- and 256-bit keys.

Note that for XTS mode, only half the key is used, so XTS-512 essentially utilizes a 256-bit key.

# Tests are approximate using memory only (no storage IO).
#  Algorithm | Key |  Encryption |  Decryption     
     aes-cbc   128b   581.3 MiB/s  1961.8 MiB/s     
     aes-cbc   256b   431.4 MiB/s  1503.1 MiB/s     
     aes-xts   256b  1665.6 MiB/s  1642.3 MiB/s     
     aes-xts   512b  1318.3 MiB/s  1282.1 MiB/s

And for Haswell:

# Tests are approximate using memory only (no storage IO).
#  Algorithm | Key |  Encryption |  Decryption     
     aes-cbc   128b   663.8 MiB/s  2486.8 MiB/s     
     aes-cbc   256b   493.9 MiB/s  2043.6 MiB/s     
     aes-xts   256b  2265.2 MiB/s  2261.1 MiB/s     
     aes-xts   512b  1778.0 MiB/s  1778.7 MiB/s

We made the following observations:

  • For CBC encryption, we see a 40% improvement for 128-bit keys over 256-bit keys.
  • For XTS encryption, we see a 30% improvement for 256-bit keys over 512-bit keys.
  • For CBC decryption, we see a 20% improvement for 128-bit keys over 256-bit keys.
  • For XTS decryption, we see a 30% improvement for 256-bit XTS keys over 512-bit keys.

Note that this is raw performance of the AES-NI instruction. In real world, there is disk I/O or network I/O that happens while data is being encrypted/decrypted, which would affect real world performance.

Also, I believe the above numbers are for single core performance, in implementations that uses multiple cores, even AES-256 can easily saturate the entire I/O bandwidth of an SSD and most networks.

As noted here though, making sure you use the right chaining mode for your purpose actually affects throughput much more significantly than the key size.

0

Yes, if your device has AES-NI, it accelerate and improve the speed of applications performing encryption and decryption using the AES encryption as you know. You already have the key on your link.

The VPN providers don't know if you have AES-NI or not. And they stay in the standard case of not having it. They recommend AES-128 which is more agile. Anyway, if you have AES-NI, AES-128 is faster than AES-256. I think we are talking about something almost imperceptible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.