3

AES256 is said to be around 20% slower than AES128 (at least it was on my own benchmark). Is it slower only because of increased computation cost or does it also involve disk access?

Let's say I upgrade my laptop to have twice as powerful a CPU but the disk has the same specs. I have been using AES128 on the old laptop and I will be using AES256 on the new laptop. Can the new setup be any slower than the previous setup for disk read / write speed or not because the performance cost is purely computational?

Maciej Kravchyk
  • 133
  • 5

2 Answers2

4

The choice of cipher (AES-128 modes, AES-256 modes or other) has no impact on the size or structure of the ciphertext. Therefore the input/output operations are exactly the same. (There might be a tiny difference when mounting the volume, but that would be negligible compared to everything else that happens when mounting a volume.)

The choice of cipher (between plausible candidates) also has a negligible impact (tens of bytes at most) on RAM usage.

AES-256 will definitely use more CPU cycles than AES-128 because it has to do more basic operations. It also uses a little more code size and active memory, so there is an indirect performance impact due to a slightly increased usage of cache memory. That's not much, but it's one of several reasons why you can't just multiply the CPU speed by the number of operations to calculate performance.

A computer with “twice as powerful a CPU” isn't actually twice as fast for sequential performance, which is what matters the most here. These days the raw speed increases relatively slowly. Processors have more core, which allows more parallelism but doesn't help much if at all with throughput when accessing a single file.

Gilles 'SO- stop being evil'
  • 19,134
  • 4
  • 50
  • 92
  • It's a good point about the cores, 2x as fast was just a made up number, I'm pretty sure I will be getting an at least 40% clock speed improvement as the laptop is pretty dated though :) Thanks! – Maciej Kravchyk Jan 08 '24 at 10:44
4

AES-256 is slower than AES-128 only because it has more rounds (14 instead of 10) and more subkeys (15 instead of 11). Block size is unchanged at 128 bits, thus the change is quite local. At worse AES-256 is 40% slower than AES-128. Typically the extra time is significantly lower, because there are other things, (most importantly disk IO in disk encryption), that add to the total time.

If the new machine has AES-NI with proper support, and the older did not, the speed gain from that will be tremendous. Much less so if both have AES-NI, but still, with the same hard disk, a new machine is probably faster with AES-256 than the old one with AES-128, thanks to better IPC, unless the CPU frequency is lower.

fgrieu
  • 140,762
  • 12
  • 307
  • 587
  • On the other hand, for the next few decades, AES-256 or AES-128 won't make a security difference in my opinion: attackers will succeed by recovering the passphrase (observing the keyboard more or less directly) or perhaps the master key, rather than thru cryptanalysis or CRQC. The evil maid does not care for how many encryption rounds there are if they can plant a rogue BIOS. – fgrieu Jan 09 '24 at 07:10