Hi Yaron, effort for XTS per cipher block is a bit higher than ESSIV, as you need one additional GF(2^128) multiplication per crypto-block. But you are right, there is only one encryption for the "IV" per sector, so performance is often compareble to ESSIV. I think XTS mode does have a potentially larger cache footprint (the multiplication). Crypto hardware typically supports CBC mode but may not support XTS mode. In the standard case these aspects do not really matter. There may also have been some confusion with EME mode. EME mode does CBC twice, with some masking step in between. Arno On Tue, May 01, 2012 at 09:26:39AM +0300, Yaron Sheffer wrote: > Hi, > > Looking back at the archives, it appears that aes-xts-plain in dm-crypt > runs at half the speed of aes-cbc-essiv: > http://www.saout.de/pipermail/dm-crypt/2010-November/001348.html. Milan > explained it at the time by XTS doing 2 AES operations for each > plaintext block. But my understanding of XTS is that it is similar to > ESSIV: 1 AES op per 16-byte block, plus 1 op for the sector. > > - Did I misread the definition of XTS, and it's really 2 AES ops per > 16-byte block? > > - Does anybody have more recent performance comparisons, confirming (or > not) the performance difference? > > Thanks, > > Yaron > > _______________________________________________ > dm-crypt mailing list > dm-crypt@xxxxxxxx > http://www.saout.de/mailman/listinfo/dm-crypt > -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@xxxxxxxxxxx GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- One of the painful things about our time is that those who feel certainty are stupid, and those with any imagination and understanding are filled with doubt and indecision. -- Bertrand Russell _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
