Checking AES-NI Availability

Luke Hebert

- 3 minutes read - 429 words

AES-NI (Advanced Encryption Standard New Instructions) can double your encryption throughput, but only if the hardware path is actually active. The commands below let you confirm at each layer, from the CPU up through Java and OpenSSL, that the instruction set is being used.

Java

$ java -XX:+PrintFlagsFinal -version | grep UseAES
     bool UseAES                                    = true            {product}
     bool UseAESIntrinsics                          = true            {product}
java version "1.7.0_67"
Java(TM) SE Runtime Environment (build 1.7.0_67-b01)
Java HotSpot(TM) 64-Bit Server VM (build 24.65-b04, mixed mode)

If both flags read true, the JVM is using AES-NI intrinsics.

OpenSSL < 1.0.1

# openssl engine -c -tt
(aesni) Intel AES-NI engine
[AES-128-ECB, AES-128-CBC, AES-128-CFB, AES-128-OFB, AES-192-ECB, AES-192-CBC, AES-192-CFB, AES-192-OFB, AES-256-ECB, AES-256-CBC, AES-256-CFB, AES-256-OFB]
     [ available ]
(dynamic) Dynamic engine loading support
     [ unavailable ]

A [ available ] status on the aesni engine confirms hardware support.

OpenSSL 1.0.0

Support is available by default if the hardware supports it, but it no longer appears in the engine list. You need to compare the speeds of the two commands below. Command B disables AES-NI hardware support detection, so the difference in throughput tells you whether the instruction set is active. Compare the final line (bytes per second) for each test.

Command A:

openssl speed -elapsed -evp aes-128-cbc

Command B:

OPENSSL_ia32cap="~0x200000200000000" openssl speed -elapsed -evp aes-128-cbc

Command A output

The numbers are in 1000s of bytes per second processed.

type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc     256238.62k   271719.70k   275356.49k   275942.06k   277325.06k

Command B output

The numbers are in 1000s of bytes per second processed.

type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc     117714.22k   136255.38k   138736.81k   142844.94k   143736.83k
Note

In this example, Command A is roughly 2x faster than Command B, confirming AES-NI is active. If the numbers are close, the hardware path is not being used.

CPU Support

# cpuid | grep -5 AES
      SSE4.2 extensions                       = true
      extended xAPIC support                  = true
      MOVBE instruction                       = false
      POPCNT instruction                      = true
      time stamp counter deadline             = true
      AES instruction                         = true
      XSAVE/XSTOR states                      = false
      OS-enabled XSAVE/XSTOR                  = false
      AVX: advanced vector extensions         = false
      F16C half-precision convert instruction = false
      RDRAND instruction                      = true

The AES instruction = true line is the key indicator.

Checking Native Hadoop Libs

hadoop checknative

This confirms that Hadoop’s native libraries were compiled with AES-NI support.

Test Unlimited Strength JCE

java -cp . ujce_test
JCE Unlimited Strength Policy files appear to be available. Max AES Cipher Key Length is 2147483647

📎 Download ujce-test.java

📎 Download ujce-test.class