7

In another question, Thomas' answer mentioned the AES-NI instruction set, which piqued my curiosity.

Is there a tool or process available out there to check whether the instruction set is available (besides comparing CPU model numbers)?

12

On Linux systems, do:

grep flags /proc/cpuinfo

This will give, for each CPU core, the list of what that core can do. The AES-NI instructions are there when the flag "aes" appears in the list of flags. See this page for a list of possible flag values.

On macOS, do:

sysctl -n machdep.cpu | grep -i aes

If it doesn't find anything, this machine doesn't have AES-NI.

For Windows, see this question on SuperUser.

2
  • THe aes flag only says when you have AES right? Not AES-NI (New instruction set)... – danger89 Sep 28 '20 at 20:57
  • Wrong, see my answer below. – danger89 Sep 28 '20 at 21:49
4

I'm not a low level hardware person any more, but an example from this post regarding a FreeBSD implemention shows you can grab info from Features2:

Features2=0x29ee3ff<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,<b17>,DCA,SSE4.1,SSE4.2,POPCNT,AESNI>
1
  • You should add how to get this output. e.g. dmesg | grep Features2 . – Matthias Weiler May 3 '17 at 15:45
3

On Windows systems, you can use free console tool "Coreinfo" from Sysinternals

2

There's also the cpuid utility available on a number of OS's (including FreeBSD, Linux, macOS, and NetBSD).

cpuid | grep -i aes
  AES instruction                         = true
3
  • On macOS, sysctl -n machdep.cpu | grep -i aes – dchest Jun 3 '17 at 14:58
  • @dchest - that's more of an answer to the original question than a comment about the cpuid answer. But FWIW, it does look like MacPorts has cpuid. – Juan Jun 6 '17 at 20:37
  • agreed, added to the accepted reply. – dchest Jun 7 '17 at 9:57
0

Since the question is about the NI (New Instruction) set for AES, NI accelerates the the AES algorithm.

A right answer could be (also according to Intel docs):

cpuid | grep -i aes | sort | uniq

If you want to be sure, you can also try the following command:

sort -u /proc/crypto | grep module

This really gives the kernel modules that are loaded, which should be aesni_intel (together with aes_x86_64), to be sure you are using the full Intel AES-NI support.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.