[dm-crypt] XTS performance

Arno Wagner arno at wagner.name
Tue May 1 11:29:47 CEST 2012

Hi Yaron,

effort for XTS per cipher block is a bit higher than ESSIV, 
as you need one additional GF(2^128) multiplication per 
crypto-block. But you are right, there is only one encryption 
for the "IV" per sector, so performance is often compareble 
to ESSIV. 

I think XTS mode does have a potentially larger cache footprint 
(the multiplication). Crypto hardware typically supports CBC 
mode but may not support XTS mode. In the standard case
these aspects do not really matter.

There may also have been some confusion with EME mode. EME 
mode does CBC twice, with some masking step in between.


On Tue, May 01, 2012 at 09:26:39AM +0300, Yaron Sheffer wrote:
> Hi,
> Looking back at the archives, it appears that aes-xts-plain in dm-crypt
> runs at half the speed of aes-cbc-essiv:
> http://www.saout.de/pipermail/dm-crypt/2010-November/001348.html. Milan
> explained it at the time by XTS doing 2 AES operations for each
> plaintext block. But my understanding of XTS is that it is similar to
> ESSIV: 1 AES op per 16-byte block, plus 1 op for the sector.
> - Did I misread the definition of XTS, and it's really 2 AES ops per
> 16-byte block?
> - Does anybody have more recent performance comparisons, confirming (or
> not) the performance difference?
> Thanks,
>     Yaron
> _______________________________________________
> dm-crypt mailing list
> dm-crypt at saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt

Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno at wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
One of the painful things about our time is that those who feel certainty 
are stupid, and those with any imagination and understanding are filled 
with doubt and indecision. -- Bertrand Russell 

More information about the dm-crypt mailing list