CPUのAES暗号化速度をCPU組込のaesサポートのありなしで測定する。

Intel CPU に搭載されたAESサポートがどれくらい強烈か比較してみたかった。

x86 の intel CPU にはAESのサポート ( AES-NI )が組み込まれていて処理速度が速いということは、知られた事実だと思う。

暗号化アクセラレータとして動作しているのですが、どれくらいの速度の恩恵が出ているのか。知りたくなった。

HTTPSやSSD/HDDの暗号化で処理速度が気になると言われたので、じゃぁ調べてみようじゃないかと。

AESのありなしで速度を測定するコマンド

CPU(AES-NI) の機能を「オフ」/disable にした場合の測定。

OPENSSL_ia32cap="~0x200000200000000" openssl speed -elapsed -evp aes-128-cbc

CPUの機能をオン / enable にした場合

openssl speed -elapsed -evp aes-128-cbc

実際に測定してみた結果

takuya@:~$ OPENSSL_ia32cap="~0x200000200000000" openssl speed -elapsed -evp aes-128-cbc
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-128-cbc for 3s on 16 size blocks:

62451619 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 64 size blocks: 18216095 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 256 size blocks: 4615725 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 1024 size blocks: 1176014 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 8192 size blocks: 147045 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 16384 size blocks: 73621 aes-128-cbc's in 3.00s
OpenSSL 1.1.1d  10 Sep 2019
built on: Wed Oct  9 01:04:37 2019 UTC
options:bn(64,64) rc4(16x,int) des(int) aes(partial) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-1.1.1d=. -specs=/usr/share/dpkg/no-pie-compile.specs -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-128-cbc     333075.30k   388610.03k   393875.20k   401412.78k   401530.88k   402068.82k

takuya@:~$ openssl speed -elapsed -evp aes-128-cbc
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-128-cbc for 3s on 16 size blocks: 153491212 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 64 size blocks: 66078098 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 256 size blocks: 16915245 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 1024 size blocks: 4232165 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 8192 size blocks: 533750 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 16384 size blocks: 266600 aes-128-cbc's in 3.00s
OpenSSL 1.1.1d  10 Sep 2019
built on: Wed Oct  9 01:04:37 2019 UTC
options:bn(64,64) rc4(16x,int) des(int) aes(partial) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-1.1.1d=. -specs=/usr/share/dpkg/no-pie-compile.specs -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-128-cbc     818619.80k  1409666.09k  1443434.24k  1444578.99k  1457493.33k  1455991.47k

type	16 bytes	64 bytes	256 bytes	1024 bytes	8192 bytes	16384 bytes
なし aes-128-cbc	333075.30k	388610.03k	393875.20k	401412.78k	401530.88k	402068.82k
あり aes-128-cbc	818619.80k	1409666.09k	1443434.24k	1444578.99k	1457493.33k	1455991.47k