AES-NI and Encrypted Storage

T

tonyb

Limp Gawd
Joined
Dec 30, 2010
Messages
130
Intel has the AES-NI instruction set, which does hardware acceleration of AES functions. Theoretically, this should increase throughput for encrypted file systems/files/etc.

It's available on the Nehalams, i5, i7s, and some others. Windows 7 should use it by default if it's there for bit locker and encrypted folders, Mac OS X doesn't use it (at least in Snow Leopard, it'd be nice if it did in Lion).

Is anyone using AES-NI specifically for encrypted files/file systems?
 
We are actually upgrading our fileserver this weekend to a Xeon with AES-NI (an E5620 specifically). It will be running ESXi with Windows Server 2008 R2 on top of it, which our encrypted array will be attached to (encrypted with truecrypt AES).

Currently the system has an AMD Athlon X2 6400+ which benchmarks in truecrypt at ~255MB/s for AES. The array before encryption benchmarks at up to ~950MB/s read which I expect to be able to attain with the new Xeon using hardware acceleration. I will give you an update with specific figures when it is operational...

But here is an interesting one I came across while researching whether the AES-NI feature will be available to a virtual machine in ESXi, it is translated from Russian.
 
AES-NI utilizes the SSE register space. It is no problem to use it in virtual machines as long as the virtual processors report the correct feature set.
 
ZFSguru and other FreeBSD platforms also can use AESNI acceleration, once the kernel module is loaded. I try to load it automatically on platforms that support it.

Speeds are 2000MB/s+ with accelerated AES and it saves your true CPU for other things going on at the same time; so this is very good if you intend to use encryption alot on your NAS.
 
You must log in or register to reply here.
Back
Top