Benchmarking The Performance Cost To Full Disk Encryption For Modern AMD Ryzen Laptops

[phoronix]

Phoronix: Benchmarking The Performance Cost To Full Disk Encryption For Modern AMD Ryzen Laptops

With the new AMD Ryzen 7 PRO 7840U Zen 4 mobile processor powering the likes of the Lenovo ThinkPad P14s Gen 4, I was curious about the performance impact of employing full disk encryption. Here are some benchmarks looking at the performance cost to enabling full disk encryption versus not utilizing any disk encryption while running Fedora Workstation on the new ThinkPad P14s Gen 4 AMD laptop.

https://www.phoronix.com/review/fedora-38-encryption

[JEBjames]

Michael

Typo on page 2.

"The SQLIte Speedtest benchmark also showed" should be "SQLite" (lowercase "i")

[bug77]

Imho, the real cost of full-disk encryption is not performance. It's that you absolutely need to have a backup solution. Because if an encrypted disk suffers any kind of failure, there's no way to get your data back.

[sharpjs]

It’s articles like this that compelled me to invest in Phoronix Premium. Glad to see I’m not leaving much, if any, performance on the table by using FDE in Linux. Thanks, Michael.

[You-]

Imho, the real cost of full-disk encryption is not performance. It's that you absolutely need to have a backup solution. Because if an encrypted disk suffers any kind of failure, there's no way to get your data back.

Oh performance can absolutely be it. Someone did some tests on Windows 11 recently and the impact according to the headlines was 45% (which i am sure will not be for all cases).

these benchmarks showing the linux impact are very useful.

[Venemo]

Michael Do you have an benchmarks for how the full-disk encryption affects battery life?

[Radtraveller]

So, full disclosure, not educated in cs or ee,
question… is it too hard or just too slow to have a dedicated chip/part of cpu that en/de-crypts ALL i/o or at least disk (maybe ram also?)
though I guess all of your data would then be tied to that chip(let) unless it could have a user set password or read from the tpm and you could set a password in the tpm?

[kylew77]

So, full disclosure, not educated in cs or ee,
question… is it too hard or just too slow to have a dedicated chip/part of cpu that en/de-crypts ALL i/o or at least disk (maybe ram also?)
though I guess all of your data would then be tied to that chip(let) unless it could have a user set password or read from the tpm and you could set a password in the tpm?

There is a specific part of certain newer chips have an instruction called AES-NI for AES encryption. For years Intel locked it out of lower market CPUs but now all modern chips have this feature. No clue why Intel locked it out of modern chips in lower markets though. Made my first Chromebook hard to use, cpu was always 25% or more on it because it was so hard to decrypt the ssd. Now my modern Jasper Lake has this instruction in it.

[ssokolow]

There is a specific part of certain newer chips have an instruction called AES-NI for AES encryption. For years Intel locked it out of lower market CPUs but now all modern chips have this feature. No clue why Intel locked it out of modern chips in lower markets though. Made my first Chromebook hard to use, cpu was always 25% or more on it because it was so hard to decrypt the ssd. Now my modern Jasper Lake has this instruction in it.

*nod* Look for aes in the /proc/cpuinfo flags field.

EDIT: Also, if you want to see if your LUKS is set up to use it, run cryptsetup benchmark and see if the aes-* rows are nearly an order of magnitude faster than the other algorithms.

[Brittle2]

Oh performance can absolutely be it. Someone did some tests on Windows 11 recently and the impact according to the headlines was 45% (which i am sure will not be for all cases).

these benchmarks showing the linux impact are very useful.

tobe fair, the linux benefities of performance don't show on day-to-day work, but this situation is where it really shine, and it didn't lose as much as on windows