Intel BX80623I72600K Manuel utilisateur

324952

Cryptographic

Performance on

the 2nd Generation

Intel® Core™

processor family

January 2011

White Paper

Vinodh Gopal

Jim Guilford

Wajdi Feghali

Erdinc Ozturk

Gil Wolrich

Kirk Yap

Sean Gulley

Martin Dixon

IA Architects

Intel Corporation

Cryptographic Performance on the

2nd Generation Intel® Core™ processor family

Executive Summary

The latest 2nd Generation Intel® Core™ processor family brings huge

performance increases to cryptographic applications.

Cryptographic algorithms consist of public and private key operations,

combined with secure hashing. We examine the performance of a small

representative set of algorithms on the new processors, and compare

with the performance of the Intel® microarchitecture code named

Westmere.

This paper describes the performance increase that can be achieved

on the 2nd Generation Intel® Core™ processor family over the Intel®

microarchitecture code named Westmere, on cryptographic

applications. We show the results on a small representative sample

set of algorithms optimized for performance on each processor. The

net result is an improvement in cryptographic performance up to

~1.8Xover the previous Intel processors1.

The Intel®Embedded Design Center provides qualified developers with

web-based access to technical resources. Access Intel Confidential design

materials, step-by step guidance, application reference solutions,

training, Intel’s tool loaner program, and connect with an e-help desk

1Software and workloads used in performance tests may have been optimized for performance

only on Intel microprocessors. Performance tests, such as SYSmark and MobileMark, are

measured using specific computer systems, components, software, operations and functions.

Any change to any of those factors may cause the results to vary. You should consult other

information and performance tests to assist you in fully evaluating your contemplated

purchases, including the performance of that product when combined with other products.

Configuration: Refer to the Performance section. For more information go to

http://www.intel.com/performance

Cryptographic Performance on the

2nd Generation Intel® Core™ processor family

and the embedded community. Design Fast. Design Smart. Get started

today. www.intel.com/embedded/edc.

Cryptographic Performance on the

2nd Generation Intel® Core™ processor family

Contents

Overview ................................................................................................................5

Improving Cryptographic Processing...........................................................................5

Multi-Buffer via SIMD .............................................................................6

Multi-Buffer via Data Dependency Hiding ..................................................6

Performance............................................................................................................7

Private-Key and Secure Hashing Performance............................................8

Public Key Encryption Performance...........................................................8

Conclusion ..............................................................................................................9

References ..............................................................................................................9

324952

Overview

Cryptographic algorithms, such as secure hashing or encryption, occur in

networking, storage and other applications. Since the amount of data being

processed is large and increasing at a rapid rate, there is an ever-increasing

need for very high performance implementations of these algorithms. The

Intel® microarchitecture code named Westmere is capable of excellent

performance as demonstrated in [2], [3] and [4]. However, the introduction

of the 2nd Generation Intel® Core™ processor family brings an additional

substantial boost in performance on cryptographic algorithms.

We examine the performance of a representative set of algorithms such as

modular exponentiation which forms the basis of most public key

cryptographic protocols, AES Encryption in the CBC Mode for

private/symmetric key encryption, and the MD5, SHA1, SHA256 secure

hashing algorithms for authentication. To compare the performance of an

algorithm on the processor families, we use the most optimized

implementation of that algorithm for each processor.

Improving Cryptographic Processing

Modular exponentiation forms the basis of almost all the prevalent public key

algorithms currently, such as the RSA, DSA and Diffie-Hellman algorithms. In

[3], we demonstrate the fastest implementation of modular exponentiation on

Intel processors. The 2nd Generation Intel® Core™ processor family improves

the performance of the multiply and adc (add with carry) instructions,

resulting in much faster modular exponentiation. Our implementation is a

constant-time one, safe from branch and cache based side-channel attacks,

and in [3] we demonstrate that our implementation is substantially faster on

Intel processors than the best-known publicly available implementation in

OpenSSL.

The hashing and private key encryption can be implemented using the multi-

buffer technique described in [4] for best performance on Intel processors.

There are two basic ways that processing multiple buffers in parallel can

improve performance: processing the buffers with SIMD instructions or

processing multiple buffers in parallel to reduce data dependency limits. In

[4], we describe how using multi-buffer techniques result in the best

performance for AES Encryption and the SHA1 secure hashing algorithm,

compared to the best single-buffer implementations. This is also the case for

the MD5 and SHA256 algorithms which are included in this study. In [4], we

describe a job scheduler to manage multiple buffers of varying sizes, for a

fully generalized solution to the multi-buffer problem for all usage models.

Cryptographic Performance on the

2nd Generation Intel® Core™ processor family

However, for simplicity, we use fixed-size small buffers without schedulers in

this paper, as we mainly focus on the performance improvements of the core

algorithms.

We did not include other algorithms in this study, as we believe the current

set is representative and forms the basis of the vast majority of cryptographic

protocols used today. Although other private key ciphers such as ARC4 and

DES are still used today, we anticipate the new AES algorithm will continue to

replace them in the future.

Multi-Buffer via SIMD

The Intel®64 and IA-32 instruction set architectures have two distinct

instruction subsets: general purpose instructions and Single Instruction

Multiple Data (SIMD) instructions [1]. SIMD instructions include, and are

mostly known as Intel®SSE (Streaming SIMD Extensions). These instructions

can be used to implement fast hashing for MD5, SHA1 and SHA256. As these

algorithms are defined on 32-bit words and perform a sequence of arithmetic

and logical operations, they are amenable to a SIMD approach where we can

process 4 independent buffers concurrently.

The 2nd Generation Intel® Core™ processor family improves the performance

of SIMD instructions with the introduction of the Intel® AVX (Intel®

Advanced Vector Extensions) instruction set [5], resulting in much faster

multi-buffer hashing. Although we process the same number of buffers as

with SSE, we gain some performance efficiency due to the more flexible

implementations operate on 128-bit data which consists of 4 data elements

from independent parallel buffers.

Multi-Buffer via Data Dependency Hiding

The Intel®AES-NI new instructions have been defined as a set of SSE

instructions, but are not SIMD. In particular the AESENC instruction, which

does one round of AES encryption, has a latency of several cycles. This means

that in some modes, such as counter-mode or CBC (Cipher Block Chaining)

decrypt, one can implement the algorithm such that multiple blocks of the

same buffer are being processed in parallel, but in the case of CBC-encrypt,

one cannot start encrypting a block until the previous block has been

encrypted. This means that CBC-encrypt requires a serial implementation,

where performance is limited by the latency rather than by the throughput.

However, if we can encrypt multiple independent buffers in parallel, we can

break the data dependencies and get ideal performance limited only by the

throughput for CBC-Encrypt. The 2nd Generation Intel® Core™ processor

family improves the throughput performance of the AES-NI instructions; to

realize this peak performance, we process 8 buffers in parallel. For the Intel

Cryptographic Performance on the

2nd Generation Intel® Core™ processor family

processors based on Intel® microarchitecture code named Westmere, we

maximize performance with 4 buffers.

Performance

The performance results provided in this section were measured on two

processors supporting Intel®AES-NI:

•Intel®Core™ i5-650 processor at a frequency of 3.20 GHz, based on

the Intel® microarchitecture code named Westmere

•Intel® Core™ i7-2600 processor at a frequency of 3.40 GHz, based on

the 2nd Generation Intel® Core™ processor family

The fact that the two processors have different clock frequencies does not

affect the comparison, as we have normalized the performance results to

cycles.

The tests, conducted by Intel, were run with Intel®Turbo Boost Technology

off, and represent the performance without Intel®Hyper-Threading

Technology (Intel®HT Technology) on a single core.

The multi-buffer code bases for AES, MD5, SHA1, SHA256 were measured on

64-byte fixed size data buffers without a scheduler. The AES-128 CBC Encrypt

implementation used pre-expanded keys. AES using 128-bit keys is a

common usage; the results will be similar and scale for other key sizes such

as 192 and 256 bit keys.

The modular exponentiation code bases were measured on 512-bit and 1024-

bit keys. These algorithms form the basis of one of the most critical Server

workloads, the RSA Signing Algorithm. RSA Sign performs a decryption

process that can be implemented efficiently with the Chinese Remainder

Theorem (CRT). As a result of the CRT implementation, RSA2048 requires

1024-bit modular exponentiation and RSA1024 requires 512-bit modular

exponentiation.

We present results here with warm data. When a test for warm data is called,

it is first run numerous times to warm up the cache.

The timing is measured using the rdtsc() function which returns the

processor time stamp counter (TSC). The TSC is the number of clock cycles

since the last reset. The ‘TSC_initial’ is the TSC recorded before the function

is called. Then, the function is called for the specified number of times for

data buffers of a given size. After the runs are complete, the rdtsc() is called

again to record the new cycle count ’TSC_final’. The effective cycle count for

the called routine is computed using

# of cycles = (TSC_final-TSC_initial)/(number of iterations).

Cryptographic Performance on the

2nd Generation Intel® Core™ processor family

Private-Key and Secure Hashing Performance

The multi-buffer performance is shown below in Table 1:

Table 1. Multi-Buffer Performance (Cycles/Byte)2

Algorithm i5-650 i7-2600 i7-2600 Gain

MD5 1.46 1.27 1.15

SHA1 2.96 2.2 1.35

SHA256 6.96 5.27 1.32

AES128-CBC-Encrypt 1.52 0.83 1.83

In all cases, we observe a large performance boost with the Intel® Core™ i7-

2600 processor based on the 2nd Generation Intel® Core™ processor family,

with gains ranging from 1.15-1.83X. The absolute performance is very

impressive as well, with 0.83 cycles/byte for AES128 and 2.2 cycles/byte

for SHA1.

Public Key Encryption Performance

The Public Key results are shown below in Table 2:

Table 2. Modular Exponentiation Performance (Cycles)2

Algorithm i5-650 i7-2600 i7-2600 Gain

512-bit Modular Exponentiation 360,880 246,899 1.46

1024-bit Modular Exponentiation 2,722,590 1,906,555 1.43

In this case, we observe a large performance boost with the Intel® Core™ i7-

2600 processor based on the 2nd Generation Intel® Core™ processor family of

~1.4X. The absolute performance of exponentiation is very impressive, with

just 246,899 cycles for a 512-bit constant-time modular exponentiation.

2Software and workloads used in performance tests may have been optimized for performance

only on Intel microprocessors. Performance tests, such as SYSmark and MobileMark, are

measured using specific computer systems, components, software, operations and functions.

Any change to any of those factors may cause the results to vary. You should consult other

information and performance tests to assist you in fully evaluating your contemplated

purchases, including the performance of that product when combined with other products.

Configuration: Refer to the Performance section. For more information go to

http://www.intel.com/performance

Cryptographic Performance on the

2nd Generation Intel® Core™ processor family

Conclusion

This paper describes the performance increase that can be achieved on the

2nd Generation Intel® Core™ processor family over the Intel®

microarchitecture code named Westmere, on cryptographic applications. We

show the results on a small representative sample set of algorithms. The net

result is an improvement in cryptographic performance up to ~1.8X3over the

previous Intel processors.

References

[1] Intel®64 and IA-32 Architectures Software Developer’s Manual Volume 1

[2] Breakthrough AES performance with Intel AES New Instructions

http://software.intel.com/file/26898

[3] Fast and Constant-time Implementation of Modular Exponentiation

http://www.cse.buffalo.edu/srds2009/escs2009_submission_Gopal.pdf

[4] Processing Multiple buffers in parallel

http://download.intel.com/design/intarch/papers/324101.pdf

[5] Intel AVX programming reference

http://softwarecommunity.intel.com/isn/downloads/intelavx/Intel-AVX-

Programming-Reference-31943302.pdf

The Intel®Embedded Design Center provides qualified developers with web-

based access to technical resources. Access Intel Confidential design

materials, step-by step guidance, application reference solutions, training,

Intel’s tool loaner program, and connect with an e-help desk and the

embedded community. Design Fast. Design Smart. Get started today.

http://intel.com/embedded/edc.

3Software and workloads used in performance tests may have been optimized for performance

only on Intel microprocessors. Performance tests, such as SYSmark and MobileMark, are

measured using specific computer systems, components, software, operations and functions.

Any change to any of those factors may cause the results to vary. You should consult other

information and performance tests to assist you in fully evaluating your contemplated

purchases, including the performance of that product when combined with other products.

Configuration: Refer to the Performance section. For more information go to

http://www.intel.com/performance

Cryptographic Performance on the

2nd Generation Intel® Core™ processor family

Authors

Vinodh Gopal, Jim Guilford, Erdinc Ozturk, Gil Wolrich,

Wajdi Feghali, Kirk Yap, Sean Gulley and Martin Dixon are

IA Architects with the IAG Group at Intel Corporation.

Acronyms

IA Intel®Architecture

API Application Programming Interface

SIMD Single Instruction Multiple Data

SSE Streaming SIMD Extensions

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Intel Matériel informatique

Intel

Intel SOM-4486 ETX Module Manuel utilisateur

Intel

Intel 80960MC Manuel utilisateur

Intel

Intel 520J - Pentium 4 2.80GHz 800MHz 1MB Socket 775... Manuel utilisateur

Intel

Intel IXDP465 Manuel utilisateur

Intel

Intel Pentium OverDrive Manuel utilisateur

Intel

Intel SRCSASLS4I - RAID Controller Manuel d'installation

Intel

Intel BX80619I73960X Manuel utilisateur

Intel

Intel SRCSAS18E - RAID Controller Manuel utilisateur

Intel

Intel RS2PI008 Manuel utilisateur

Intel

Intel 865G Manuel utilisateur

Intel

Intel Atom C2000 Manuel utilisateur

Intel

Intel Xeon 5600 Series Manuel technique

Intel

Intel DH61BE Guide de configuration

Intel

Intel F-Tile SDI II Intel Agilex Manuel utilisateur

Intel

Intel BV80605001914AG - Processor - 1 x Xeon X3430 Manuel utilisateur

Intel

Intel 945G - Bulk Single Unit Atx Exp Manuel utilisateur

Intel

Intel Xeon E5-2400 Mode d’emploi

Intel

Intel RS3FC044 Manuel utilisateur

Intel

Intel PENTIUM PRO Manuel utilisateur

Intel

Intel NUC 13 Extreme Kit NUC13RNGi9 Manuel utilisateur

Intel

Intel MFS5000SI - Multi-Flex Server Compute Module Manuel utilisateur

Intel

Intel KOTETSU Mark II Manuel utilisateur

Intel

Intel Pentium II OverDrive Manuel utilisateur

Intel

Intel Terasic FLIK Manuel utilisateur

Manuels Matériel informatique populaires d'autres marques

EMC2

EMC2 VNX Series Manuel du propriétaire

Panasonic

Panasonic DV0PM20105 Manuel utilisateur

Mitsubishi Electric

Mitsubishi Electric Q81BD-J61BT11 Manuel utilisateur

Gigabyte

Gigabyte B660M DS3H AX DDR4 Manuel utilisateur

Raidon

Raidon iT2300 Manuel utilisateur

National Instruments

National Instruments PXI-8186 Manuel utilisateur

Hauppauge

Hauppauge WinTV-HVR-2250 Manuel utilisateur

Kontron

Kontron CP6002 Manuel utilisateur

Manhattan

Manhattan 702843 Manuel utilisateur

Aphex

Aphex 230 Manuel utilisateur

AMD

AMD Phenom II Manuel d'exploitation

dbx

dbx Zone Pro 1260 Manuel utilisateur

Galaxy

Galaxy GHDX2-2430S-24F4D Manuel utilisateur

Kontron

Kontron DIMM-PC/MD Manuel utilisateur

ST X-NUCLEO-SAFEA1B Mode d'emploi

STEINWAY LYNGDORF

STEINWAY LYNGDORF SP-1 Manuel utilisateur

Advantech

Advantech ASMB-935 Series Manuel utilisateur

Jupiter

Jupiter RAM PACK Manuel utilisateur