9

I wrote a basic function to test the speed of the AES-256-CBC mode of the Node.js built-in crypto functions. These functions use OpenSSL, so they should support AES-NI, but when I correctly enable AES-NI and do a command-line test of OpenSSL the encryption speed is ~350MB/s on OpenSSL and only ~100MB/s on Node.js Crypto.

I used this answer to enable OpenSSL AES-NI in the command line and ran it as follows:

openssl speed -evp aes-256-cbc

My question is, how do I make the speed of the Node.js crypto functions for AES match that of OpenSSL run in the command line? I suspect the reason is failure to use AES-NI

4
  • 1
    Did you compile node or using a binary
    – user568109
    Commented Oct 11, 2013 at 9:24
  • Compiled it v 0.10.20
    – Philberg
    Commented Oct 11, 2013 at 20:14
  • 5
    If you are using the latest openssl, you don't need to do anything. This optimisation is done when compiling openssl with -mtune/-maes flag. See security.stackexchange.com/questions/11815/… . Right now I don't know if these options are used or not. All I know is that it is compiled with node-gyp for that, see github.com/joyent/node/blob/master/deps/openssl/openssl.gyp.
    – user568109
    Commented Oct 18, 2013 at 4:23
  • 350MB/s is pretty low for AES-NI based AES, I would have expected about twice that number. I wonder if that's caused by CBC encryption being sequential. Do your numbers differ for CBC decryption or CTR? Commented Feb 24, 2015 at 9:27

2 Answers 2

3

It seems that this was not correctly enabled until the latest release v0.12 (that was just released publicly).

Some of the notes are available here http://strongloop.com/strongblog/performance-node-js-v-0-12-whats-new/

2

No, you are doing it right. The performance of OpenSSL in Node is a bit disappointing. Most production Node.js deployments terminate SSL connections in something other than Node.js and then forward the unencrypted connections to Node.js.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.