what could cause ecb mode decrypt to be slower than ecb mode encrypt?

Question

what could cause ecb mode decrypt to be slower than ecb mode encrypt?

davidalide opened this issue 3 years ago · 2 comments

davidalide commented 3 years ago

on x86 linux, ecb decrypt seems 2x slower than encrypt
on stm32 M4f, i am seeing a factor of 6x difference

I am using the ecb encrypt/decrypt to implement aes-xts mode

I would think cbc mode would also show the same difference since both use underlying cipher, invcipher functions

openssl aes speed test doesn't show this difference so i don't think its fundamental to algorithm

Answer 1 · 2021-08-30T13:08:26.000Z

Hi @davidalide and thanks for your interest :)

The encryption process is usually much faster than decryption. The reason has to do with the implementation.

The MixColumns-operation is faster to calculate than the InvMixColumns. This is usually alleviated a bit with HW-instructions like AES-NI (which is what the OpenSSL uses). That is probably the reason you see a larger difference on the software-implementation than on OpenSSL (2x vs 6x difference).

You can see some of the same effect in BearSSL: https://www.bearssl.org/speed.html

See these questions/answers for more context
https://crypto.stackexchange.com/questions/27872/aes-decryption-vs-encryption-speed
https://crypto.stackexchange.com/questions/5603/on-the-fly-computation-of-aes-round-keys-for-decryption

This is quite a slow implementation because of the way it is written (with compactness as main focus).

You can gain a lot of speed simply by choosing an implementation that uses lookup-tables.

I hope that helped answer your questions. Otherwise please feel free to get back :)

Answer 2 · 2021-08-30T15:26:11.000Z

Thanks for the explanation. Makes sense. Regards,dave Sent from Mail for Windows From: kokkeSent: Monday, August 30, 2021 9:08 AMTo: kokke/tiny-AES-cCc: davidalide; MentionSubject: Re: [kokke/tiny-AES-c] what could cause ecb mode decrypt to be slower than ecb mode encrypt? (#196) Hi @davidalide and thanks for your interest :)The encryption process is usually much faster than decryption. The reason has to do with the implementation.The MixColumns-operation is faster to calculate than the InvMixColumns. This is usually alleviated a bit with HW-instructions like AES-NI (which is what the OpenSSL uses). That is probably the reason you see a larger difference on the software-implementation than on OpenSSL (2x vs 6x difference).You can see some of the same effect in BearSSL: https://www.bearssl.org/speed.htmlSee these questions/answers for more contexthttps://crypto.stackexchange.com/questions/27872/aes-decryption-vs-encryption-speedhttps://crypto.stackexchange.com/questions/5603/on-the-fly-computation-of-aes-round-keys-for-decryptionThis is quite a slow implementation because of the way it is written (with compactness as main focus).You can gain a lot of speed simply by choosing an implementation that uses lookup-tables.I hope that helped answer your questions. Otherwise please feel free to get back :)—You are receiving this because you were mentioned.Reply to this email directly, view it on GitHub, or unsubscribe.Triage notifications on the go with GitHub Mobile for iOS or Android.