ChaCha20 vs AES256-GCM with and without AES-NI

gistfile1.txt

## Tested using Openssl 1.1.x dev

# Includes AES-NI instructions
> openssl speed -evp aes-256-gcm
Doing aes-256-gcm for 3s on 16 size blocks: 30117671 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 64 size blocks: 22859303 aes-256-gcm's in 2.99s
Doing aes-256-gcm for 3s on 256 size blocks: 9684550 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 1024 size blocks: 2922877 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 8192 size blocks: 387788 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 16384 size blocks: 194832 aes-256-gcm's in 3.00s
version: 3.0.0-dev
built on: built on: Thu Jan 31 22:58:16 2019 UTC
options:bn(64,64) rc4(16x,int) des(int) aes(partial)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O0 -g -g3 -fPIC -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DSSL_FORBID_ENULL -DOPENSSL_NO_DTLS1 -DOPENSSL_NO_HEARTBEATS
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-256-gcm     160627.58k   489296.12k   826414.93k   997675.35k  1058919.77k  1064042.50k

# Hardware acceleration enabled
# ChaCha20-Poly1305 is ~80% as fast as AES-NI AES256-GCM
> openssl speed -evp chacha20-poly1305
Doing chacha20-poly1305 for 3s on 16 size blocks: 21345755 chacha20-poly1305's in 3.00s
Doing chacha20-poly1305 for 3s on 64 size blocks: 15314220 chacha20-poly1305's in 2.99s
Doing chacha20-poly1305 for 3s on 256 size blocks: 8099381 chacha20-poly1305's in 3.00s
Doing chacha20-poly1305 for 3s on 1024 size blocks: 2437056 chacha20-poly1305's in 3.00s
Doing chacha20-poly1305 for 3s on 8192 size blocks: 320545 chacha20-poly1305's in 3.00s
Doing chacha20-poly1305 for 3s on 16384 size blocks: 161062 chacha20-poly1305's in 3.00s
version: 3.0.0-dev
built on: built on: Thu Jan 31 22:58:16 2019 UTC
options:bn(64,64) rc4(16x,int) des(int) aes(partial)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O0 -g -g3 -fPIC -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DSSL_FORBID_ENULL -DOPENSSL_NO_DTLS1 -DOPENSSL_NO_HEARTBEATS
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
chacha20-poly1305   113844.03k   327796.01k   691147.18k   831848.45k   875301.55k   879613.27k

# Disabled AES-NI instructions
# ~80% performance drop compared to AES-NI AES256-GCM
> OPENSSL_ia32cap="~0x200000200000000" ./openssl speed -evp aes-256-gcm
Doing aes-256-gcm for 3s on 16 size blocks: 10103716 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 64 size blocks: 3122605 aes-256-gcm's in 2.99s
Doing aes-256-gcm for 3s on 256 size blocks: 2045038 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 1024 size blocks: 560802 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 8192 size blocks: 71721 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 16384 size blocks: 35886 aes-256-gcm's in 3.00s
version: 3.0.0-dev
built on: built on: Thu Jan 31 22:58:16 2019 UTC
options:bn(64,64) rc4(16x,int) des(int) aes(partial)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O0 -g -g3 -fPIC -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DSSL_FORBID_ENULL -DOPENSSL_NO_DTLS1 -DOPENSSL_NO_HEARTBEATS
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-256-gcm      53886.49k    66838.37k   174509.91k   191420.42k   195846.14k   195985.41k

# Hardware acceleration disabled.
# ChaCha20-Poly1305 is ~400% faster than non AES-NI AES256-GCM
> OPENSSL_ia32cap="~0x200000200000000" ./openssl speed -evp chacha20-poly1305
Doing chacha20-poly1305 for 3s on 16 size blocks: 22067571 chacha20-poly1305's in 3.00s
Doing chacha20-poly1305 for 3s on 64 size blocks: 15462193 chacha20-poly1305's in 2.99s
Doing chacha20-poly1305 for 3s on 256 size blocks: 8112002 chacha20-poly1305's in 3.00s
Doing chacha20-poly1305 for 3s on 1024 size blocks: 2442349 chacha20-poly1305's in 3.00s
Doing chacha20-poly1305 for 3s on 8192 size blocks: 320626 chacha20-poly1305's in 3.00s
Doing chacha20-poly1305 for 3s on 16384 size blocks: 161136 chacha20-poly1305's in 3.00s
version: 3.0.0-dev
built on: built on: Thu Jan 31 22:58:16 2019 UTC
options:bn(64,64) rc4(16x,int) des(int) aes(partial)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O0 -g -g3 -fPIC -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DSSL_FORBID_ENULL -DOPENSSL_NO_DTLS1 -DOPENSSL_NO_HEARTBEATS
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
chacha20-poly1305   117693.71k   330963.33k   692224.17k   833655.13k   875522.73k   880017.41k