[dm-crypt] XTS performance
arno at wagner.name
Tue May 1 11:29:47 CEST 2012
effort for XTS per cipher block is a bit higher than ESSIV,
as you need one additional GF(2^128) multiplication per
crypto-block. But you are right, there is only one encryption
for the "IV" per sector, so performance is often compareble
I think XTS mode does have a potentially larger cache footprint
(the multiplication). Crypto hardware typically supports CBC
mode but may not support XTS mode. In the standard case
these aspects do not really matter.
There may also have been some confusion with EME mode. EME
mode does CBC twice, with some masking step in between.
On Tue, May 01, 2012 at 09:26:39AM +0300, Yaron Sheffer wrote:
> Looking back at the archives, it appears that aes-xts-plain in dm-crypt
> runs at half the speed of aes-cbc-essiv:
> http://www.saout.de/pipermail/dm-crypt/2010-November/001348.html. Milan
> explained it at the time by XTS doing 2 AES operations for each
> plaintext block. But my understanding of XTS is that it is similar to
> ESSIV: 1 AES op per 16-byte block, plus 1 op for the sector.
> - Did I misread the definition of XTS, and it's really 2 AES ops per
> 16-byte block?
> - Does anybody have more recent performance comparisons, confirming (or
> not) the performance difference?
> dm-crypt mailing list
> dm-crypt at saout.de
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno at wagner.name
GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
One of the painful things about our time is that those who feel certainty
are stupid, and those with any imagination and understanding are filled
with doubt and indecision. -- Bertrand Russell
More information about the dm-crypt