<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I've been wondering how and when OpenSSL decides whether it can use
the new aes instructions? Does it decide at build time or at run
time? <br>
<br>
If I build on a CPU that supports aes instructions but run on a cpu
that does not, will bad things happen? Or is OpenSSL smart enough
to call functions implemented without aes instructions in that case?<br>
<br>
Norm Green<br>
<br>
<div class="moz-cite-prefix">On 8/10/16 06:28, Jan Just Keijser
wrote:<br>
</div>
<blockquote cite="mid:57AB2BE1.7080301@nikhef.nl" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<div class="moz-cite-prefix">Hi,<br>
<br>
On 10/08/16 14:25, Nagesh shamnur wrote:<br>
</div>
<blockquote
cite="mid:4AC96705FB868F42B2075BA50F806DEB55CF95AD@szxeml512-mbs.china.huawei.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=UTF-8">
<meta name="Generator" content="Microsoft Word 12 (filtered
medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]-->
<style><!--
/* Font Definitions */
@font-face
{font-family:宋体;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:华文细黑;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"\@宋体";
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"\@华文细黑";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="2050" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">Hi
Group,<o:p></o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">
I am running an application which transfers huge chunks of
data every second (850Mbps) and the same is secured using
openssl. However the CPU usage on windows is very high ( ~
100%). So as a part of the analysis, I stumbled upon the
information that, when using AES encryption, if the
underlying hardware is Intel CPU, it can support AES-NI
instruction set and hence make the crypto processing
faster. So, I wanted to confirm if the same is enabled in
my hardware. <o:p></o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">
So, I wanted to know how to verify if the run is able to
use the AES-NI instruction set available in the hardware.<o:p></o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">
I have built openssl and have ensured enabling the asm in
both linux and windows build.<o:p></o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D"><o:p> </o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">
For windows, to confirm if AES-NI is enabled, support of
tools available like truecrypt, CPU-Z and blackbox were
used if the same was enabled in OS usage. And I found that
the same is disabled. Also I found in some blogs that the
same needs to be enabled in BIOS. When checked the BIOS
settings, the option was not be found and a BIOS update is
required to enable the same.<o:p></o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline;font-variant-ligatures:
normal;font-variant-caps: normal;orphans: 2;widows:
2;-webkit-text-stroke-width: 0px;min-height:
8pt;word-spacing:0px"> <span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D"><o:p> </o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;text-indent:36.0pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">However
in linux I was unable to conclude if AES-NI is disabled
since I didn’t had access to any such tools on linux. I
checked "#cpuinfo | grep aes" and i was unable to find any
line regarding AES-NI. However when i run the ./openssl
speed -evp aes-128-gcm and
OPENSSL_ia32cap="~0x200000200000000" ./openssl speed
-elapsed -evp aes-128-gcm i am able to find the difference
in speed. So i wanted to check how to confirm if my linux
build has AES-NI enabled or not?<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D"><o:p> </o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">Environment
Information:<o:p></o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">CPU:
E5-2620 0 @2.0GHz<o:p></o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">OS:
Windows Server 2008<o:p></o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">Linux:
Ubuntu 3.11.0-15-generic<o:p></o:p></span></p>
<p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">Openssl
versoin: 1.0.2h<o:p></o:p></span></p>
<br>
</div>
</blockquote>
I've got a server with that exact same CPU over here; with openssl
1.0.2d I see the following results:<br>
<br>
$ ./openssl speed -evp aes-128-gcm<br>
[...]<br>
type 16 bytes 64 bytes 256 bytes 1024 bytes
8192 bytes<br>
aes-128-gcm 184391.41k 465791.06k 689190.61k .65k
781295.62k<br>
<br>
$ OPENSSL_ia32cap=0 ./openssl speed -evp aes-128-gcm<br>
[...]<br>
type 16 bytes 64 bytes 256 bytes 1024 bytes
8192 bytes<br>
aes-128-gcm 43906.03k 49490.24k 51037.70k
51554.65k 51699.71k<br>
<br>
i.e. with AES-NI disabled performance is about ~15 times less. On
this CPU turboboost is not working so your numbers maybe slightly
different.<br>
Another good way to test whether AES-NI is working is by comparing
BF-CBC to AES-256-CBC: without AES-NI, BF will be faster. with
AES-NI, AES will be faster.<br>
<br>
HTH,<br>
<br>
JJK<br>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>