4 ms·
FDE is not overrated and should have a 0% impact on performance if your CPU has AES instructions. Modern CPUs can do AES faster than your SSD, sometimes faster
by keep_reading 3y ago
FDE is not overrated and should have a 0% impact on performance if your CPU has AES instructions.
Modern CPUs can do AES faster than your SSD, sometimes faster than an NVME can read/write
- delusional 3y agoThat's not how you asses performance at all. Maybe you can saturate the NVMe link with AES in idea circumstances, but you may be killing memory mapping and churning I$. To say anything interesting about performance on these modern machines, you would have to benchmark some real workload.
- auspiv 3y ago5 year old CPUs (Intel i7-6700, for example) do 2.6GB/s. https://calomel.org/aesni_ssl_performance.html https://calomel.org/aesni_ssl_performance.html First gen Ryzen (similar age) does 8.2GB/s, which is faster than PCIe 4 NVMe drives. https://www.vortez.net/articles_pages/amd_ryzen_7_1800x_review,9.html https://www.vortez.net/articles_pages/amd_ryzen_7_1800x_revi... Somewhat recent intel i7-12700H does 14.8GB/s, which is about the limit of PCIe 5 NVMe drives. https://www.notebookcheck.net/Intel-Core-i7-12700H-Processor-Benchmarks-and-Specs.589170.0.html https://www.notebookcheck.net/Intel-Core-i7-12700H-Processor... Edit: here's a list of AES speeds via truecrypt. top of the charts is the Ryzen 9 7950X at 32GB/s. https://www.notebookcheck.net/Benchmarks-and-Test-Results.142793.0.html?type=&sort=&max_results=500&archive=1&or=0&showBars=1&bench_93_363=1&model=1&cpu_name=1&gpu_name=1 https://www.notebookcheck.net/Benchmarks-and-Test-Results.14...
- keep_reading 3y agoThank you for looking up the most recent performance numbers. People have no idea how incredible they are and how "free" FDE has become.
- squeaky-clean 3y agoHow much does this affect other processes happening at the same time? If I'm playing an open world game that streams the environment off the ssd, how much is this going to contend with my cpu issuing draw calls, doing physics calculations, etc.
- jiggawatts 3y agoSpeaking of which, software that doesn’t use the AES-NI instructions is becoming glaringly obvious because the performance difference is so huge. In the era of mechanical drives and 2 Mbps “broadband” nobody would notice. Now with SSDs and gigabit home internet, people do notice but vendors are still pretending they can just ignore the need to offload encryption. VPN products and IPsec especially is almost always a disaster in my experience. When evaluating any kind of network security product like a virtual WAN appliance, tunnel, or whatever, check the throughput. If it can get tens of gigabits for a single stream then it is using some sort of offload. If it seems to hit the wall at around 1.5 Gbps per core, do not buy.
- ilyt 3y agoAES instructions still fill CPU's time regardless of how fast they run Doing 2.6GB/s in single thread means you have one core less to use...
- keep_reading 3y agoI run FDE on all my machines, encryption and sector sizes are aligned, I can still do a 3000MB/s IO no problem. Doesn't affect anything I'm running, even databases like Postgres.
- wkat4242 3y agoAES-NI is not 100% offloading. It only offloads the heaviest parts. The penalty is not huge especially compared to fully software implementations but it's not zero. And it takes memory bandwidth too. I don't use FDE on my gaming system for this reason. It's a big heavy PC that never leaves my house with not really any personal data anyway.