AES-GCM bandwidth

[benishay]

hi, i adding a support to AES-GCM to the engine and i getting a low bandwidth when im using iperf with tls.. when i using iperf with software i getting 10-12 Gbits and when im using the engine i get 3 Gbits.. this is logical?? or i didnt use the engine properly?? thanks

[stevelinsell]

Hi @benishay, that would depend on a number of things:

• Is you application using the AES-GCM in the engine asynchronously or synchronously, i.e. is the application/libssl creating an ASYNC_WAIT_CTX and a job for each connection/request?
• What size of requests are you making to AES-GCM? The larger the request (up to 16KB) the more efficient it will be to offload.
• Is your application running single or multithreaded? Is it doing much in parallel, i.e. are there multiple connections or just a single one for the benchmarks you are running?

Running asynchronously with 16KB requests to encrypt I would expect the performance to be fairly comparable (if there are plenty of multiple requests going on in parallel, much slower if not). Using smaller packets I would expect SW to see better performance however you run. Running synchronously I would expect SW to give you several times better performance if you are not running lots of connections in parallel threads due to the latency of offloading an individual request.

AES-GCM is best utilized directly at the QuickAssist API rather than through an OpenSSL engine if at all possible so you can eliminate as much as possible the copying between memory buffers that adds overhead.

Kind Regards,

Steve.

[benishay]

Hi Steve,

• My testing setup is the Iperf application using OPENSSL api to create a SLL_CTX which by using it will encrypt and send data to the server. I am testing the additions I made to the engine code by sending packets of ~16KB using OPENSSL API with one thread over 30 seconds.
• My application is using synchronously in the ENGINE. I do know asynchronously will increase the performance of the application by some levels. but I have hard time doing it correctly and would be happy to some material on the matter.
• I am aware of the engine overhead, but I must use it is supposed to be used by the OPENSSL api.
• We tested the memory bandwidth of the card using Intel-PCM and the result was 100 times more then not using it - does it make sense?

Would appreciate your help, Ben