I have a HW-accelerated AES processor. With that in mind, my first question would be:

Do AES-NI instructions accelerate both AES-128 and AES-256 encryption / decryption?

Secondly, if it is true, that these CPUs accelerate both lengths, why would some VPN providers recommend AES-128 for speed?

2 Answers 2


Yes, AES-NI accelerates both AES-128 and AES-256, and yes, there is a performance difference between hardware accelerated AES-128 and AES-256, according to https://software.intel.com/en-us/articles/intel-aes-ni-performance-enhancements-hytrust-datacontrol-case-study#_Toc397546813:

On Ivy Bridge here are the raw numbers for both Cyber-Block-Chaining (CBC) and XEX-based tweaked-codebook mode with ciphertext stealing (XTS) modes with both 128- and 256-bit keys.

Note that for XTS mode, only half the key is used, so XTS-512 essentially utilizes a 256-bit key.

# Tests are approximate using memory only (no storage IO).
#  Algorithm | Key |  Encryption |  Decryption     
     aes-cbc   128b   581.3 MiB/s  1961.8 MiB/s     
     aes-cbc   256b   431.4 MiB/s  1503.1 MiB/s     
     aes-xts   256b  1665.6 MiB/s  1642.3 MiB/s     
     aes-xts   512b  1318.3 MiB/s  1282.1 MiB/s

And for Haswell:

# Tests are approximate using memory only (no storage IO).
#  Algorithm | Key |  Encryption |  Decryption     
     aes-cbc   128b   663.8 MiB/s  2486.8 MiB/s     
     aes-cbc   256b   493.9 MiB/s  2043.6 MiB/s     
     aes-xts   256b  2265.2 MiB/s  2261.1 MiB/s     
     aes-xts   512b  1778.0 MiB/s  1778.7 MiB/s

We made the following observations:

  • For CBC encryption, we see a 40% improvement for 128-bit keys over 256-bit keys.
  • For XTS encryption, we see a 30% improvement for 256-bit keys over 512-bit keys.
  • For CBC decryption, we see a 20% improvement for 128-bit keys over 256-bit keys.
  • For XTS decryption, we see a 30% improvement for 256-bit XTS keys over 512-bit keys.

Note that this is raw performance of the AES-NI instruction. In real world, there is disk I/O or network I/O that happens while data is being encrypted/decrypted, which would affect real world performance.

Also, I believe the above numbers are for single core performance, in implementations that uses multiple cores, even AES-256 can easily saturate the entire I/O bandwidth of an SSD and most networks.

As noted here though, making sure you use the right chaining mode for your purpose actually affects throughput much more significantly than the key size.

  • I've found this strange comparison. Why did they not compared software CBC-128 to AES-NI CBC-128?
    – kelalaka
    Commented Dec 31, 2019 at 16:37
  • That 30% is not a massive improvement. I did not find any benchmark, but I guess ChaCha20 can do something similar without HW acceleration. Since more and more ppl use it instead of AES I am not sure if it is worth to buy a CPU with AES-NI if one has a better alternative without it. What do you think?
    – inf3rno
    Commented Oct 7, 2020 at 13:04
  • 1
    30% is the difference between choosing different key sizes, it's not the difference between using AES-NI vs pure software AES implementations, which can go between 3x to 10x improvements. ChaCha20 is popular for mobile devices which doesn't support hardware accelerated AES, but if your hardware supports it, hardware accelerated AES is still much faster than ChaCha20. The question is moot anyway though, pretty much all new x86 CPUs (desktop/laptop) sold nowadays supports AES-NI. You'll have to find a decade old CPU stock to find one that doesn't.
    – Lie Ryan
    Commented Oct 7, 2020 at 14:25

Yes, if your device has AES-NI, it accelerate and improve the speed of applications performing encryption and decryption using the AES encryption as you know. You already have the key on your link.

The VPN providers don't know if you have AES-NI or not. And they stay in the standard case of not having it. They recommend AES-128 which is more agile. Anyway, if you have AES-NI, AES-128 is faster than AES-256. I think we are talking about something almost imperceptible.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .