I want to encrypt a part of my HDD. But before that I wanted to benchmark the different algorithm available wondering if I should choose
Note: I don't have
aes hardware acceleration. The benchmarks were repeated multiple times without much change. I'd like to state clearly that these benchmark are only valid on my computer (Debian, core 2 duo). This is not intended to be a complete LUKS-TrueCrypt comparison.
TL;DR: go to part 4
So I downloaded
cryptsetup v1.6.0 to make use of the new
cryptsetup benchmark command.
# Algorithm | Key | Encryption | Decryption aes-cbc 128b 128,2 MiB/s 157,2 MiB/s serpent-cbc 128b 49,6 MiB/s 57,7 MiB/s twofish-cbc 128b 138,0 MiB/s 183,8 MiB/s aes-cbc 256b 97,5 MiB/s 121,9 MiB/s serpent-cbc 256b 51,8 MiB/s 57,7 MiB/s twofish-cbc 256b 139,0 MiB/s 183,8 MiB/s aes-xts 256b 156,4 MiB/s 157,8 MiB/s serpent-xts 256b 55,7 MiB/s 58,7 MiB/s twofish-xts 256b 161,5 MiB/s 165,9 MiB/s aes-xts 512b 120,5 MiB/s 120,9 MiB/s serpent-xts 512b 55,7 MiB/s 58,5 MiB/s twofish-xts 512b 161,5 MiB/s 165,3 MiB/s
serpentis surprisingly fast at decrypting!
serpentis clearly the fastest.
- The key size seem to have almost no noticable effect on
aesdoes not behave well when the key size is increased.
Updates out of VM
I was really surprised as
aes is known to be the fastest (even without hardware acceleration). So I downloaded
TrueCrypt to double-check these results.
TrueCrypt uses the
xts mode by default so I assume it also use it in its benchmarks.
- Tools > Benchmark
- Choose any buffer size (here, 5MB)
- Click on "Benchmark"
# Algorithm | Encryption | Decryption AES 106 MB/s 107 MB/s Twofish 78 MB/s 76 MB/s Serpent 41 MB/s 42 MB/s
These results corresponds much more to what is expected but do not match well with
3- General thoughts
cryptsetupprovided better general performance than
TrueCryptin this case. This could be explained the following way:
cryptsetupwas compiled on my system with compiler optimization routines while
TrueCryptwas already compiled in a generic way;
cryptsetupuses kernelspace crypto modules while
TrueCryptuses userspace crypto routines.
- However, I can't explain why
serpent-xts-512seems to be the way to go with
aes-xtsthe only cipher worth using.
TrueCrypt give completely different qualitative (relative cipher speed) and quantitative (actual speed of each cipher) results in in-RAM benchmarks.
- Is that something you have already noticed?
- Should I trust
serpent-xts-512cipher for speed?