[dm-crypt] Recommended modes for performance (SMP+AES-NI)

Brad House brad at monetra.com
Mon Jun 27 17:38:44 CEST 2011

We're in the process of building a new fileserver which will
be using dm-crypt, and are trying to get a game plan together
on what mode of operation will be best for a good ratio of
performance and security.

Initially the machine will be a 6-core Xeon which supports
the AES-NI instruction set, but a second identical CPU may be
dropped-in, in the future.  It will be connected to the network
by at least one 10Gbps NIC.

Obviously, we'll be making sure to use 2.6.38 or higher in
order to utilize the multi-cpu scaling enhancements to

I think we've settled on AES-256, but may entertain AES-128
if there is a huge performance difference as I think AES-128
is still considered sufficiently safe for our purposes.

So, the question is mainly what mode of operation would be
  - cbc-essiv
  - ctr-{plain64|essiv}
  - xts-{plain64|essiv}
  - are there any others I should be considering?
NOTE: I'm not sure if essiv is even an option for CTR or XTS
       modes, I'd like feedback on that, as well as what the
       security implications are...

At this point, I'm leaning towards CTR mode, mainly because it
was designed explicitly to be parallelizable:

And it appears Intel has explicitly submitted a patch to optimize
dm-crypt for AES-NI with this mode of operation:

I know "test it" is going to be the obvious answer, and we will,
but I don't want to make any decisions that could severely impact
security for a little extra speed.  Well, that, and our hardware
is on order and probably won't be in for 3 weeks ;)

Any suggestions/feedback would be greatly appreciated.


More information about the dm-crypt mailing list