[dm-crypt] XTS performance

[dm-crypt] XTS performance

[Yaron Sheffer]

Hi,

Looking back at the archives, it appears that aes-xts-plain in dm-crypt
runs at half the speed of aes-cbc-essiv:
http://www.saout.de/pipermail/dm-crypt/2010-November/001348.html. Milan
explained it at the time by XTS doing 2 AES operations for each
plaintext block. But my understanding of XTS is that it is similar to
ESSIV: 1 AES op per 16-byte block, plus 1 op for the sector.

- Did I misread the definition of XTS, and it's really 2 AES ops per
16-byte block?

- Does anybody have more recent performance comparisons, confirming (or
not) the performance difference?

Thanks,

     Yaron

Re: [dm-crypt] XTS performance

[Arno Wagner]

Hi Yaron,

effort for XTS per cipher block is a bit higher than ESSIV, 
as you need one additional GF(2^128) multiplication per 
crypto-block. But you are right, there is only one encryption 
for the "IV" per sector, so performance is often compareble 
to ESSIV. 

I think XTS mode does have a potentially larger cache footprint 
(the multiplication). Crypto hardware typically supports CBC 
mode but may not support XTS mode. In the standard case
these aspects do not really matter.

There may also have been some confusion with EME mode. EME 
mode does CBC twice, with some masking step in between.

Arno



On Tue, May 01, 2012 at 09:26:39AM +0300, Yaron Sheffer wrote:
> Hi,
> 
> Looking back at the archives, it appears that aes-xts-plain in dm-crypt
> runs at half the speed of aes-cbc-essiv:
> http://www.saout.de/pipermail/dm-crypt/2010-November/001348.html. Milan
> explained it at the time by XTS doing 2 AES operations for each
> plaintext block. But my understanding of XTS is that it is similar to
> ESSIV: 1 AES op per 16-byte block, plus 1 op for the sector.
> 
> - Did I misread the definition of XTS, and it's really 2 AES ops per
> 16-byte block?
> 
> - Does anybody have more recent performance comparisons, confirming (or
> not) the performance difference?
> 
> Thanks,
> 
>     Yaron
> 
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
> 

-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
One of the painful things about our time is that those who feel certainty 
are stupid, and those with any imagination and understanding are filled 
with doubt and indecision. -- Bertrand Russell 

Re: [dm-crypt] XTS performance

[Heinz Diehl]

On 01.05.2012, Arno Wagner wrote: 

> There may also have been some confusion with EME mode. EME 
> mode does CBC twice, with some masking step in between.

EME is what the commercial PGP uses. This could be the cause why
people report some serious performance impact with it...

[dm-crypt] XTS performance

[Yaron Sheffer]

Hi,

Looking back at the archives, it appears that AES-XTS in dm-crypt runs 
at half the speed of AES-CBC-ESSIV: 
http://www.saout.de/pipermail/dm-crypt/2010-November/001348.html. Milan 
explained it at the time by XTS doing 2 AES operations for each 
plaintext block. But my understanding of XTS is that it is similar to 
ESSIV: 1 AES op per 16-byte block, plus 1 op for the sector.

- Did I misread the definition of XTS, and it's really 2 AES ops per 
16-byte block?

- Does anybody have more recent performance comparisons, confirming (or 
not) the performance difference?

Thanks,

     Yaron