OpenSSL AES Geschwindigkeit mit EVP und ohne AES-NI unterschiedlich

1328
chew socks

Mein Computer hat kein AES-NI, aber wenn ich openssl speedmit und ohne laufe, -evpsehe ich einen Geschwindigkeitsunterschied. Warum ist das?

openssl speed aes-128-cbc Doing aes-128 cbc for 3s on 16 size blocks: 18132001 aes-128 cbc's in 3.00s Doing aes-128 cbc for 3s on 64 size blocks: 4890318 aes-128 cbc's in 3.00s Doing aes-128 cbc for 3s on 256 size blocks: 1246069 aes-128 cbc's in 3.00s Doing aes-128 cbc for 3s on 1024 size blocks: 311859 aes-128 cbc's in 3.00s Doing aes-128 cbc for 3s on 8192 size blocks: 38970 aes-128 cbc's in 3.00s OpenSSL 1.0.1f 6 Jan 2014 built on: Thu Jun 11 15:30:15 UTC 2015 options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) blowfish(idx)  compiler: cc -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128 cbc 96704.01k 104326.78k 106331.22k 106447.87k 106414.08k

Und

openssl speed -evp aes-128-cbc Doing aes-128-cbc for 3s on 16 size blocks: 90633962 aes-128-cbc's in 2.99s Doing aes-128-cbc for 3s on 64 size blocks: 24880226 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 256 size blocks: 7574778 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 1024 size blocks: 1962765 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 8192 size blocks: 247920 aes-128-cbc's in 2.99s OpenSSL 1.0.1f 6 Jan 2014 built on: Thu Jun 11 15:28:12 UTC 2015 options:bn(64,64) rc4(8x,int) des(idx,cisc,16,int) aes(partial) blowfish(idx)  compiler: cc -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 484997.79k 530778.15k 646381.06k 669957.12k 679251.05k
2

1 Antwort auf die Frage

1
Mahmoud Al-Qudsi

evp kontrolliert nicht nur AES_NI, sondern eine ganze Reihe von CPU-Intrinsics und -Optimierungen, da eine völlig andere Implementierung des AES-Algorithmus verwendet wird, die versucht, die Hardware und den Compiler so gut wie möglich zu nutzen. Diese Antwort von security.stackexchange erklärt es viel besser als ich kann.

Verwandte Probleme