Subject: [saag] Followup on mic comments

From: Yoav Nir <[email-masked]>
Date: Thu, 4 Apr 2019 18:49:11 +0300

Hi

This is following up on my mic comment at the SAAG meeting.

In the Snow-V Stream Cipher presentation (SNOW-V Stream Cipher <https://datatracker.ietf.org/meeting/104/materials/slides-104-saag-snow-v-stream-cipher-00>), the claim was made that existing ciphers such as AES-GCM and ChaCha20-Poly1305 were not fast enough for the application.

I said that I had recently measured throughput on a relatively new CPU and got better results.  Now that I am back at work, I have the exact numbers.

So the server in question is a regular Intel-based server. The CPU model is an Intel Xeon Gold 6150 running at 2.7 GHz, a relatively high-end processor from late 2017.
https://ark.intel.com/content/www/us/en/ark/products/120490/intel-xeon-gold-6150-processor-24-75m-cache-2-70-ghz.html <https://ark.intel.com/content/www/us/en/ark/products/120490/intel-xeon-gold-6150-processor-24-75m-cache-2-70-ghz.html>

I used the “openssl speed” utility to measure the throughput, with version 1.1.1b of OpenSSL 

Results:
AES-128-GCM:  5.341661 GB/s
AES-256-GCM: 3.907859 GB/s
ChaCha20-Poly1305: 2.420072 GB/s 

Translating to Gb/s these give 42.73, 31.26, and 19.36 Gb/s respectively.

Yoav

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 4 Apr 2019 10:53:28 -0500

> Translating to Gb/s these give 42.73, 31.26, and 19.36 Gb/s respectively.

"openssl speed" is not necessarily the best/well-specified benchmark.
Please supply the exact command-line used (noting that you tend to need to
use '-evp foo' in order to actually use the hardware support).

-Ben

---

From: Yoav Nir <[email-masked]>
Date: Thu, 4 Apr 2019 22:50:39 +0300

> On 4 Apr 2019, at 18:53, Benjamin Kaduk <[email-masked]> wrote:
> 

Not the best or most well-specified, but easily the most available.

You need the -evp flag to even test AES-GCM or ChaCha20-Poly1305.  So the command-line I used was:
openssl speed -evp aes-128-gcm
openssl speed -evp aes-256-gcm
openssl speed -evp chacha20-poly1305

In all cases I used the value it output for 8192-byte blocks.

Yoav

---

From: John Mattsson <[email-masked]>
Date: Sat, 6 Apr 2019 10:19:59 +0000

Hi,

Thanks again for your comments and suggestions Yoav. As you saw in my follow up post, I have already updated the performance numbers by running my own. The benchmarks that I found online and presented at SAAG turned out to be LibreSSL. Confusing that the LibreSSL command line utility is called 'openssl'. LibreSSL is significantly slower that OpenSSL.

>the claim was made that existing ciphers such as AES-GCM and ChaCha20-Poly1305 >were not fast enough for the application.

The claim was only that ChaCha20-Poly1305 at 5 Gbps was not fast enough. AES-256-GCM clearly meets 3GPP's requirements on just a single core. ChaCha20-Poly1305 at 18 Gbps is getting closer, but 30 Gbps is clearly better in terms of CPU utilization.

Numbers below from OpenSSL 1.1.1b on an i7-6700K 4.0 GHz.

openssl speed -evp "cipher_name"

                        1024 bytes          16384 bytes
aes-256-ctr             32.23 Gbps          36.59 Gbps
aes-256-gcm             28.48 Gbps          36.01 Gbps
aes-256-ocb             31.02 Gbps          36.24 Gbps
chacha20                26.17 Gbps          27.72 Gbps
chacha20-poly1305       17.61 Gbps          19.29 Gbps

Numbers below from OpenSSL 1.1.1b on an i7-8650U 1.9 GHz (16384 bytes).

openssl speed -evp "cipher_name"

AES-256-CTR             34.78 Gbps          Assembly, OpenSSL 1.1.1
AES-256-GCM             34.58 Gbps          Assembly, OpenSSL 1.1.1

Numbers below from C++ code on an 7-8650U 1.9 GHz (long plaintexts)

SNOW-V                  64.01 Gbps          C++, Alexander Maximov
SNOW-V-GCM              42.40 Gbps          C++, Alexander Maximov
AES-256-CTR             35.75 Gbps          C++, Alexander Maximov
AES-256-GCM             25.50 Gbps          C++, Alexander Maximov

Note that CPU frequency is no longer fixed and that CPUs dynamically increase their frequency to meet performance demands or lower their frequency to meet thermal requirements.
The CPUs I tested on only have AVX2 while your CPU has AVX-512. Still the numbers for AES-GCM are quite similar if one assumes that the CPUs ran at their Turbo frequencies during the benchmarks.  This seems to indicate that AVX-512 were not utilized in your benchmarks and that an AES-GCM implementation that made use of AVX-512 could be significantly faster (theoretically twice as fast). It could of course also indicate that AVX-512 does not provide much speedup for AES-GCM.

Cheers,
John

From: saag <[email-masked]> on behalf of Yoav Nir <[email-masked]>
Date: Thursday, 4 April 2019 at 21:51
To: Benjamin Kaduk <[email-masked]>
Cc: Security Area Advisory Group <[email-masked]>
Subject: Re: [saag] Followup on mic comments

On 4 Apr 2019, at 18:53, Benjamin Kaduk <[email-masked]<mailto:[email-masked]>> wrote:

Hi

Results:

You need the -evp flag to even test AES-GCM or ChaCha20-Poly1305.  So the command-line I used was:
·         openssl speed -evp aes-128-gcm
·         openssl speed -evp aes-256-gcm
·         openssl speed -evp chacha20-poly1305

Yoav