Newsgroup: it.comp.os.linux.sys
Titolo: cifrato o non cifrato ?

server centos 6.5
cosi' partizionato
 
sda1 = /
sda2 = swap
sda3 = /mnt/cifrati
 
 
 
sda3 e' cifrato con cryptsetup . Mi han chiesto cosi'. successivamente
mi fanno notare che fare copia/incolla (da rete, su share samba) da
sda1 raggiunge 80 mb/sec , mentre da sda3 tocca appena i 40 mb/sec , 
nella migliore delle condizioni.
domanda , come posso velocizzare in un qualunque modo cryptsetup senza 
eliminare la partizione sda3 , ricrearla ... ecc ecc
 
??
 
 
grazie
 

 eliminare la partizione sda3 , ricrearla ... ecc ecc
 
Mah, se la CPU ha AES-NI, non ci dovrebbero
esserci problemi.
Altrimenti... E` un problema...
 
Detto altrimenti, che io sappia, non c'e` realmente
un modo per velocizzare cryptsetup.
 
Tra l'altro, controlla con "top" l'uso della CPU
durante tali trasferimenti, giusto per capire se
e` un problema di CPU oppure altro.
 
Se la CPU ha AES-NI, allora forse hai una qualche
versione vecchia del kernel che non supporta tali
istruzioni.
 
Prova anche:
 
cryptsetup benchmark
 
E vedi cosa ti dice.
 
bye,
 
-- 
 
piergiorgio

On 2016-06-18 23:18, syspkq wrote:
[...]
Giusto per avere un idea, su un PC con AES-NI ho:
 
$ cryptsetup benchmark
# Tests are approximate using memory only (no storage IO).
PBKDF2-sha1       416763 iterations per second for 256-bit key
PBKDF2-sha256     518071 iterations per second for 256-bit key
PBKDF2-sha512     371835 iterations per second for 256-bit key
PBKDF2-ripemd160  292245 iterations per second for 256-bit key
PBKDF2-whirlpool  139290 iterations per second for 256-bit key
#  Algorithm | Key |  Encryption |  Decryption
     aes-cbc   128b   490.4 MiB/s  1823.2 MiB/s
 serpent-cbc   128b    67.8 MiB/s   279.7 MiB/s
 twofish-cbc   128b   159.2 MiB/s   217.4 MiB/s
     aes-cbc   256b   366.8 MiB/s  1433.6 MiB/s
 serpent-cbc   256b    73.9 MiB/s   281.1 MiB/s
 twofish-cbc   256b   165.9 MiB/s   216.6 MiB/s
     aes-xts   256b  1553.5 MiB/s  1498.5 MiB/s
 serpent-xts   256b   266.8 MiB/s   272.9 MiB/s
 twofish-xts   256b   207.4 MiB/s   210.9 MiB/s
     aes-xts   512b  1231.7 MiB/s  1165.4 MiB/s
 serpent-xts   512b   266.7 MiB/s   275.6 MiB/s
 twofish-xts   512b   209.4 MiB/s   208.0 MiB/s
 
Su uno senza AES-NI ho:
 
$ cryptsetup benchmark
# Tests are approximate using memory only (no storage IO).
PBKDF2-sha1       170223 iterations per second for 256-bit key
PBKDF2-sha256     215224 iterations per second for 256-bit key
PBKDF2-sha512     131334 iterations per second for 256-bit key
PBKDF2-ripemd160  125068 iterations per second for 256-bit key
PBKDF2-whirlpool   53894 iterations per second for 256-bit key
#  Algorithm | Key |  Encryption |  Decryption
     aes-cbc   128b    75.6 MiB/s    93.7 MiB/s
 serpent-cbc   128b    33.0 MiB/s    89.4 MiB/s
 twofish-cbc   128b    75.7 MiB/s    82.6 MiB/s
     aes-cbc   256b    62.4 MiB/s    72.1 MiB/s
 serpent-cbc   256b    36.7 MiB/s    89.4 MiB/s
 twofish-cbc   256b    81.9 MiB/s    82.4 MiB/s
     aes-xts   256b    94.2 MiB/s    94.1 MiB/s
 serpent-xts   256b    82.8 MiB/s    83.8 MiB/s
 twofish-xts   256b    76.2 MiB/s    76.8 MiB/s
     aes-xts   512b    73.3 MiB/s    72.9 MiB/s
 serpent-xts   512b    84.3 MiB/s    83.6 MiB/s
 twofish-xts   512b    76.4 MiB/s    76.8 MiB/s
 
Non poca differenza...
 
bye,
 
-- 
 
piergiorgio


 
 
Grazie, lunedi' controllo.
 
ciauz

AMD X6 10...@3.5GHz
# Tests are approximate using memory only (no storage IO).
PBKDF2-sha1       374491 iterations per second
PBKDF2-sha256     229146 iterations per second
PBKDF2-sha512     153840 iterations per second
PBKDF2-ripemd160  321254 iterations per second
PBKDF2-whirlpool  154566 iterations per second
#  Algorithm | Key |  Encryption |  Decryption
      aes-cbc   128b   179,0 MiB/s   193,0 MiB/s
  serpent-cbc   128b    94,6 MiB/s   237,0 MiB/s
  twofish-cbc   128b   204,2 MiB/s   256,0 MiB/s
      aes-cbc   256b   142,0 MiB/s   149,0 MiB/s
  serpent-cbc   256b    96,0 MiB/s   235,0 MiB/s
  twofish-cbc   256b   206,0 MiB/s   256,0 MiB/s
      aes-xts   256b   194,0 MiB/s   196,0 MiB/s
  serpent-xts   256b   215,0 MiB/s   219,0 MiB/s
  twofish-xts   256b   235,0 MiB/s   232,0 MiB/s
      aes-xts   512b   147,0 MiB/s   150,0 MiB/s
  serpent-xts   512b   216,0 MiB/s   219,0 MiB/s
  twofish-xts   512b   235,0 MiB/s   233,0 MiB/s
 
i5 46...@2.3Ghz
# Tests are approximate using memory only (no storage IO).
PBKDF2-sha1       468114 iterations per second
PBKDF2-sha256     288704 iterations per second
PBKDF2-sha512     186181 iterations per second
PBKDF2-ripemd160  392431 iterations per second
PBKDF2-whirlpool  204800 iterations per second
#  Algorithm | Key |  Encryption |  Decryption
      aes-cbc   128b   559,0 MiB/s  2411,0 MiB/s
  serpent-cbc   128b    76,0 MiB/s   490,0 MiB/s
  twofish-cbc   128b   161,0 MiB/s   309,0 MiB/s
      aes-cbc   256b   419,0 MiB/s  1857,0 MiB/s
  serpent-cbc   256b    76,4 MiB/s   486,0 MiB/s
  twofish-cbc   256b   159,0 MiB/s   309,0 MiB/s
      aes-xts   256b  2120,0 MiB/s  2134,0 MiB/s
  serpent-xts   256b   481,0 MiB/s   471,0 MiB/s
  twofish-xts   256b   296,0 MiB/s   303,0 MiB/s
      aes-xts   512b  1626,0 MiB/s  1631,0 MiB/s
  serpent-xts   512b   487,0 MiB/s   472,0 MiB/s
  twofish-xts   512b   299,0 MiB/s   301,0 MiB/s
 
 
 

Come vedi sull'I5 le prestazioni di AES-* sono su un altro livello
 rispetto all'AMD. 
 
-- 
 
 
----Android NewsGroup Reader----
http://usenet.sinaapp.com/
 

  rispetto all'AMD. 
 
La cosa piu` interessante e` fare un test parallelo,
cioe` lanciare "cryptsetup benchmark" 4 oppure 8 volte.
 
Su due macchine, con CPU quad core senza HT (per intel),
2.8GHz entrambe, le prestazioni rimangono abbastanza
costanti nel caso di intel, mentre crollano nel caso AMD.
 
bye,
 
-- 
 
piergiorgio

 costanti nel caso di intel, mentre crollano nel caso AMD.
 
Li entrano in gioco troppi fattori estranei pero', per AMD
di che cpu parliamo? Perche le ultime con i moduli al posto dei core
necessitano di uno scheduling accurato.
 
Giulia
 
 

 necessitano di uno scheduling accurato.
 
Un Opteron 3350 HE.
 
Io credo, suppongo, che il problema maggiore
sia la cache.
 
bye,
 
-- 
 
piergiorgio