I'm worried about performance in a Data Lake used for Data Science purposes. I need to encrypt confidential data and, because of definitions I won't dive into here, the algorithm to fulfill this requirement has to be AES-256.

However, I'm well aware that, under the assumption that everything else has been done just fine, AES-128 is more than enough to secure my data.

There's also a benchmark made by Crypto++ that shows how practically slower AES-256 can be when compared to AES-128, but I don't believe I can use this benchmark to all kinds of implementations.

The question is: Am I exaggerating my concerns in the reduction of performance when using either AES-128 or AES-256?

  • 2
    yes, it's slower, for sure. How much slower? That depends a lot on how much hardware help the operation is getting, CPUs can accelerate the process if all the ducks are in a row, so results can vary quite a bit. You will need to test in your environment to tell how fast it will be in your environment.
    – dandavis
    Commented Mar 13, 2019 at 17:20
  • What kind of performance do you need? Most processors these days contain dedicated hardware instructions to speed up AES operations. My computer can do over 1 gigabit / second of aes-256 cbc using openssl. Commented Mar 13, 2019 at 17:21
  • @AndrolGenhald The point of the question is that, even if I speed up AES operations by hardware intructions, wouldn't it be better to do the same but with AES-128?
    – franpen
    Commented Mar 13, 2019 at 17:23
  • Your title does not reflect your question very well. From the benchmarks you've linked and other websites, it is rather obvious that the answer is "yes". It is also more of a "is the tower of Pisa taller than the tower of Ghenjei": looking it up is faster than asking us (and from the question body, it's clear that you did your homework).
    – Luc
    Commented Mar 13, 2019 at 17:23
  • @franpen Does it really matter? If you can have performance that's 100x what you need, or 60x what you need but marginally more secure, why bother arguing? You've already said you have to use AES-256. It only matters if it's actually a bottleneck. Commented Mar 13, 2019 at 17:26

2 Answers 2


So in the benchmarks you've linked, the difference is about 40%. If that is too much for your purposes because it would cost too much server capacity, then it's too much. If not, then it's not too much. If you want to know if it's too much for a user, you could do a quick blind test and see if they even notice the difference in practice (if you can't use the real code, just make a dummy site where the operation is 40% slower).

You say you don't think those benchmarks apply to each language, and you're right, but they are ballpark accurate. Save for bugs, another language is not suddenly going to be 140% slower. Because of that, other benchmarks won't make a difference in your decision. And if 35% is acceptable but 40% is not, then you should really benchmark on your own hardware with the software that you will actually be using.


The results are not surprising. AES-128 has 10 rounds and AES-256 has 14 rounds and each has 128-bit block size. So, in theory, you expect at least %40 slow down on AES-256 compared to AES-128. You can find similar results at BearSLL

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .