A Look At The Big Impact To AES-XTS Encryption Performance From Spectre Retpolines

[phoronix]

Phoronix: A Look At The Big Impact To AES-XTS Encryption Performance From Spectre Retpolines

With it recently being noticed that the Linux AES-NI XTS performance regressed big time from the return trampolines "Retpolines" enacted nearly three years ago as a defense against Spectre, here are some benchmarks looking at the performance cost involved to this day using Retpolines and the impact on the XTS encryption/decryption performance measured by cryptsetup that is used for setting up encrypted disks under Linux...

http://www.phoronix.com/scan.php?page=news_item&px=Retpolines-Cryptsetup-Perf

[Guest]

Mainly relevant for people who use an NVME SSD with partitions encrypted using AES. Definitely a big performance hit.

[AJenbo]

Isn't that the default for Ubuntu disk encryption? Sounds like that would affect a lot of buisnesses.

[muncrief]

Yikes!!! That's truly amazing. And my goodness Michael is correct, how on Earth could this have gone unnoticed for so long?

[kylew77]

I wonder if this affects the *BSDs performance on encrypted drives as well? My workstation running FreeBSD with encrypted Geli drive with ZFS on a NVMe SSD has always felt slower than it should I thought. Wonder if mitigations in FreeBSD affected AES encryption too?

[microcode]

Once you factor in the clocking impacts of AES-NI, it seems you can be better off with full software ChaCha20 in these cases, and you get the added benefit that there are zero realistic timing attacks against ChaCha20, almost no matter how you implement it; and then if you compare it to ChaCha12 or ChaCha8 (which is at least as secure as AES, ChaCha20 is overkill) it starts looking real funny.