XTS performance

Hi,

Looking back at the archives, it appears that aes-xts-plain in dm-crypt runs at half the speed of aes-cbc-essiv:
http://www.saout.de/pipermail/dm-crypt/2010-November/001348.html. Milan explained it at the time by XTS doing 2 AES operations for each plaintext block. But my understanding of XTS is that it is similar to
ESSIV: 1 AES op per 16-byte block, plus 1 op for the sector.

- Did I misread the definition of XTS, and it's really 2 AES ops per 16-byte block?

- Does anybody have more recent performance comparisons, confirming (or not) the performance difference?

Thanks,

Yaron

Hi Yaron,

effort for XTS per cipher block is a bit higher than ESSIV, as you need one additional GF(2^128) multiplication per crypto-block. But you are right, there is only one encryption for the "IV" per sector, so performance is often compareble to ESSIV.

I think XTS mode does have a potentially larger cache footprint (the multiplication). Crypto hardware typically supports CBC mode but may not support XTS mode. In the standard case these aspects do not really matter.

There may also have been some confusion with EME mode. EME mode does CBC twice, with some masking step in between.

Arno

Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: [email protected] 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
One of the painful things about our time is that those who feel certainty 
are stupid, and those with any imagination and understanding are filled 
with doubt and indecision. -- Bertrand Russell 

EME is what the commercial PGP uses. This could be the cause why people report some serious performance impact with it...