<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">Hi,<br>
      <br>
      On 10/08/16 14:25, Nagesh shamnur wrote:<br>
    </div>
    <blockquote
cite="mid:4AC96705FB868F42B2075BA50F806DEB55CF95AD@szxeml512-mbs.china.huawei.com"
      type="cite">
      <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <meta name="Generator" content="Microsoft Word 12 (filtered
        medium)">
      <!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]-->
      <style><!--
/* Font Definitions */
@font-face
        {font-family:宋体;
        panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
        {font-family:华文细黑;
        panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:"\@宋体";
        panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
        {font-family:"\@华文细黑";
        panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0cm;
        margin-bottom:.0001pt;
        font-size:11.0pt;
        font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
p
        {mso-style-priority:99;
        mso-margin-top-alt:auto;
        margin-right:0cm;
        mso-margin-bottom-alt:auto;
        margin-left:0cm;
        font-size:12.0pt;
        font-family:"Times New Roman","serif";}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:"Calibri","sans-serif";
        color:windowtext;}
.MsoChpDefault
        {mso-style-type:export-only;}
@page WordSection1
        {size:612.0pt 792.0pt;
        margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
        {page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="2050" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
      <div class="WordSection1">
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">Hi
            Group,<o:p></o:p></span></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">           
            I am running an application which transfers huge chunks of
            data every second (850Mbps) and the same is secured using
            openssl. However the CPU usage on windows is very high ( ~
            100%). So as a part of the analysis, I stumbled upon the
            information that, when using AES encryption, if the
            underlying hardware is Intel CPU, it can support AES-NI
            instruction set and hence make the crypto processing faster.
            So, I wanted to confirm if the same is enabled in my
            hardware. <o:p></o:p></span></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">           
            So, I wanted to know how to verify if the run is able to use
            the AES-NI instruction set available in the hardware.<o:p></o:p></span></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">           
            I have built openssl and have ensured enabling the asm in
            both linux and windows build.<o:p></o:p></span></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D"><o:p> </o:p></span></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">           
            For windows, to confirm if AES-NI is enabled, support of
            tools available like truecrypt, CPU-Z and blackbox were used
            if the same was enabled in OS usage. And I found that the
            same is disabled. Also I found in some blogs that the same
            needs to be enabled in BIOS. When checked the BIOS settings,
            the option was not be found and a BIOS update is required to
            enable the same.<o:p></o:p></span></p>
        <p
          style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline;font-variant-ligatures:
          normal;font-variant-caps: normal;orphans: 2;widows:
          2;-webkit-text-stroke-width: 0px;min-height:
          8pt;word-spacing:0px">
          <span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D"><o:p> </o:p></span></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;text-indent:36.0pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">However
            in linux I was unable to conclude if AES-NI is disabled
            since I didn’t had access to any such tools on linux. I
            checked "#cpuinfo | grep aes" and i was unable to find any
            line regarding AES-NI. However when i run the ./openssl
            speed -evp aes-128-gcm and
            OPENSSL_ia32cap="~0x200000200000000" ./openssl speed
            -elapsed -evp aes-128-gcm i am able to find the difference
            in speed. So i wanted to check how to confirm if my linux
            build has AES-NI enabled or not?<o:p></o:p></span></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D"><o:p> </o:p></span></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">Environment
            Information:<o:p></o:p></span></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">CPU:
            E5-2620 0 @2.0GHz<o:p></o:p></span></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">OS:
            Windows Server 2008<o:p></o:p></span></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">Linux:
            Ubuntu 3.11.0-15-generic<o:p></o:p></span></p>
        <p
style="margin:0cm;margin-bottom:.0001pt;line-height:15.75pt;background:white;vertical-align:baseline"><span
style="font-size:10.5pt;font-family:"Arial","sans-serif";color:#3D3D3D">Openssl
            versoin: 1.0.2h<o:p></o:p></span></p>
        <br>
      </div>
    </blockquote>
    I've got a server with that exact same CPU over here; with openssl
    1.0.2d I see the following results:<br>
    <br>
    $ ./openssl  speed -evp aes-128-gcm<br>
    [...]<br>
    type             16 bytes     64 bytes    256 bytes   1024 bytes  
    8192 bytes<br>
    aes-128-gcm     184391.41k   465791.06k   689190.61k   .65k  
    781295.62k<br>
    <br>
    $ OPENSSL_ia32cap=0 ./openssl  speed -evp aes-128-gcm<br>
    [...]<br>
    type             16 bytes     64 bytes    256 bytes   1024 bytes  
    8192 bytes<br>
    aes-128-gcm      43906.03k    49490.24k    51037.70k    51554.65k   
    51699.71k<br>
    <br>
    i.e. with AES-NI disabled performance is about ~15 times less. On
    this CPU turboboost is not working so your numbers maybe slightly
    different.<br>
    Another good way to test whether AES-NI is working is by comparing
    BF-CBC to AES-256-CBC: without AES-NI, BF will be faster. with
    AES-NI, AES will be faster.<br>
    <br>
    HTH,<br>
    <br>
    JJK<br>
    <br>
  </body>
</html>