I'm working on embedded software, where I used the cryptsetup to create an encrypted disk space over a NFS ethernet standard connection... I'm interested to understand the writing speed that this disk achieves (simple performance analysis).
First I run a standard benchmark
root@sbc-lynx:/mnt# cryptsetup benchmark # Tests are approximate using memory only (no storage IO). PBKDF2-sha1 33098 iterations per second for 256-bit key PBKDF2-sha256 52851 iterations per second for 256-bit key PBKDF2-sha512 34492 iterations per second for 256-bit key PBKDF2-ripemd160 29789 iterations per second for 256-bit key PBKDF2-whirlpool 7062 iterations per second for 256-bit key # Algorithm | Key | Encryption | Decryption aes-cbc 128b 26.7 MiB/s 24.5 MiB/s serpent-cbc 128b 6.6 MiB/s 7.3 MiB/s twofish-cbc 128b 10.2 MiB/s 11.0 MiB/s aes-cbc 256b 21.4 MiB/s 20.8 MiB/s serpent-cbc 256b 6.6 MiB/s 7.3 MiB/s twofish-cbc 256b 10.2 MiB/s 10.2 MiB/s aes-xts 256b 9.0 MiB/s 9.0 MiB/s serpent-xts 256b 7.0 MiB/s 7.2 MiB/s twofish-xts 256b 10.7 MiB/s 10.9 MiB/s aes-xts 512b 7.1 MiB/s 7.0 MiB/s serpent-xts 512b 7.0 MiB/s 7.1 MiB/s twofish-xts 512b 10.7 MiB/s 10.9 MiB/s
Just for the testing purpose I choose to se eaes-cbc-256 that seems to have good performances.
But now I want to test the real speed achieved. my NFS is mounted in /mnt/ and the encrypted folder is correctly mounted in /home/encryptroot/ . I used:
time dd bs=5M count=1 if=/dev/zero of=/mnt/ppx conv=fsync 1+0 records in 1+0 records out real 0m0.556s user 0m0.000s sys 0m0.110s time dd bs=5M count=1 if=/dev/zero of=/home/encryptroot/ppx conv=fsync 1+0 records in 1+0 records out real 0m1.104s user 0m0.000s sys 0m0.180s
From these results I obtained in normal folder a speed of almost 9 MB/s
While for the encrypted folder I obtained 4 MB/s
Question1) Is this a valid method to evaluate writing speed? using the param fsync this should evaluate the time used to really copy the file in disk (not to copy in caches)?
I'm not satisfied by this results, because with a potential of 20 MB/s encryption I can't fill the total bandwidth available (around 9 MB/s).
Final investigation: I changed the cipher and used the default aes-xts that should achieve a max of 9MB/s I repeated
time dd bs=5M count=1 if=/dev/zero of=/home/encryptroot/ppx conv=fsync 1+0 records in 1+0 records out real 0m2.281s user 0m0.000s sys 0m0.180s
Obtaining a writing speed of 2.2 MB/s.
Question2) there are other factors to consider that I'm missing to analyze these results? It's possible that the overhead of the xts is so high to reduce the throughput ? And have other test to suggest?