In another question, Thomas' answer mentioned the AES-NI instruction set, which piqued my curiosity.
Is there a tool or process available out there to check whether the instruction set is available (besides comparing CPU model numbers)?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
On Linux systems, do:
grep flags /proc/cpuinfo
This will give, for each CPU core, the list of what that core can do. The AES-NI instructions are there when the flag "
aes" appears in the list of flags. See this page for a list of possible flag values.
On macOS, do:
sysctl -n machdep.cpu | grep -i aes
If it doesn't find anything, this machine doesn't have AES-NI.
For Windows, see this question on SuperUser.
I'm not a low level hardware person any more, but an example from this post regarding a FreeBSD implemention shows you can grab info from Features2:
On Windows systems, you can use free console tool "Coreinfo" from Sysinternals
There's also the
cpuid utility available on a number of OS's (including FreeBSD, Linux, macOS, and NetBSD).
cpuid | grep -i aes AES instruction = true
Since the question is about the NI (New Instruction) set for AES, NI accelerates the the AES algorithm.
A right answer could be (also according to Intel docs):
cpuid | grep -i aes | sort | uniq
If you want to be sure, you can also try the following command:
sort -u /proc/crypto | grep module
This really gives the kernel modules that are loaded, which should be
aesni_intel (together with
aes_x86_64), to be sure you are using the full Intel AES-NI support.