Jtdylktuy

In Linux (Fedora 28) I have my home directory LUKS encryped, when using Gnome Disk (screenshot), I can benchmark separately the underlying LUKS partition (upper blue rectangle) and the decrypted home partition (lower white rectanble).

The LUKS partition gives an access time of 500MB/s, but the decryped acces gives 350MB/s. To be clear this is the same partition a 500GB SSD.

Is it fair to conclude that encryption is slowing down data access by 30% ( = 150/500)?

Is this type of number documented or I am doing some thing wrong.
This is much more slowdown that I was expecting.

EDIT: This is my output for

$ cryptsetup benchmark

# Tests are approximate using memory only (no storage IO).

PBKDF2-sha1       384375 iterations per second for 256-bit key

PBKDF2-sha256     494611 iterations per second for 256-bit key

PBKDF2-sha512     323634 iterations per second for 256-bit key

PBKDF2-ripemd160  293225 iterations per second for 256-bit key

PBKDF2-whirlpool  185917 iterations per second for 256-bit key

argon2i       4 iterations, 748334 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)

argon2id      4 iterations, 745443 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)

#     Algorithm |       Key |      Encryption |      Decryption

        aes-cbc        128b       195.0 MiB/s       664.0 MiB/s

    serpent-cbc        128b        28.8 MiB/s        94.7 MiB/s

    twofish-cbc        128b        58.8 MiB/s       111.6 MiB/s

        aes-cbc        256b       146.5 MiB/s       507.3 MiB/s

    serpent-cbc        256b        33.3 MiB/s       110.2 MiB/s

    twofish-cbc        256b        59.3 MiB/s       123.6 MiB/s

        aes-xts        256b       433.7 MiB/s       416.8 MiB/s

    serpent-xts        256b       101.0 MiB/s        94.7 MiB/s

    twofish-xts        256b       111.8 MiB/s       110.3 MiB/s

        aes-xts        512b       349.5 MiB/s       356.6 MiB/s

    serpent-xts        512b       101.6 MiB/s        96.0 MiB/s

    twofish-xts        512b       111.2 MiB/s       108.1 MiB/s

$ lscpu | grep aes

Flags:               fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge 

mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall

 nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology

 nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx est 

tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer

 aes xsave avx f16c rdrand lahf_lm cpuid_fault epb pti ssbd ibrs ibpb stibp

 tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt dtherm 

ida arat pln pts flush_l1d

NOTE: this question is crossposted here: https://ask.fedoraproject.org/en/question/130463/how-to-activate-the-aes-module-cpu-decryptor/

Encryption adds extra CPU load, as each disk block needs to be decrypted by the OS on access. Your test results (~600 MB/s decryption) are fairly average for generic AES processing on an i7.

To avoid this issue, modern CPUs generally come with hardware-based AES support built in. Intel calls this feature "AES-NI" (shown in lscpu as "aes"), and it allows reaching 2–3 GB/s rates for the same AES decryption.

First run lscpu and check whether it mentions "aes" among feature flags. The Intel ARK shows it as present in your CPU model, but it may be disabled by firmware (BIOS) settings. (The ARK has a footnote: "Some products can support AES New Instructions with a Processor Configuration update … Please contact OEM for the BIOS that includes the latest Processor configuration update.")

Linux uses the "aesni_intel" module to enable hardware acceleration. Check whether it's enabled in your kernel at all by running zgrep AES_NI_INTEL /proc/config.gz. If it shows "=y", it's part of the main kernel image and should be available.

If the output shows "=m", it's been compiled as a module – try to load the module manually by running sudo modprobe -v aesni_intel. If the command is unable to find the module, you probably have to reboot. (After reboot, make sure uname -r shows the same kernel version as in ls /lib/modules.)