Performance of aes-256-ccm

[tochlab]

System information

Type | Version/Name
Distribution Name | gentoo
Distribution Version |24.05.2020
Linux Kernel |5.4.38-gentoo-x86_64
Architecture | x86_64
ZFS Version | 0.8.4-r0-gentoo
SPL Version | 0.8.4-r0-gentoo

Describe the problem you're observing

SSD: WD BLUE 3D NAND SATA SSD 1 TB (WDS100T2B0A)
CPU: Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz

I have about a 200MBytes/s write speed on encrypted(aes-256-ccm) and uncompressed pool and about 500Mbytes/s on the same device using ext4.

Describe how to reproduce the problem

dd if=/dev/zero of=test.bin bs=1M count=32768

I understand that there is some performance penalties due to enabled encryption, but is it normal halving speed on modern CPU with hardware AES and AVX?

[AttilaFueloep]

I understand that there is some performance penalties due to enabled encryption, but is it normal halving speed on modern CPU with hardware AES and AVX?

Unfortunately two factors contribute to suboptimal native encryption performance, the need to handle FPU state inside ZFS due to copyright woes and a mostly C based implementation of the algorithms. If you're interested in the details please have a look at #9749.

A fix for AES-GCM went into 0.8.4, so if you have the chance I'd recommend using AES-GCM in lieu of AES-CCM, that should give you a distinct performance gain. You can do that by creating an aes-256-gcm encrypted dataset and moving your data there (or by restoring from backup into such a dataset).

[scineram]

Is there no more optimized code available to be used for CCM?

[AttilaFueloep]

@scineram There is, but since CCM is 3-4 times slower than GCM anyhow it didn't seem worth the effort of porting it. See here and above.

[tochlab]

Thanks for detailed response. Switching to GCM helps.