Home / ubuntu / Questions / 43021
In Process
MagicFab
Asked: 2011-05-16 11:29:28 +0800 CST

Is AES-NI fully supported?

  • 772

Has support for the Intel AES-NI hardware crypto acceleration been added to Ubuntu (LUKS, kernel, OpenSSL libs, etc)? If so, starting with which version?

Here is a list of Intel processors supporting AES-NI:

More about AES-NI:

I am mostly interested in finding out if this effectively suppresses / diminishes any performance penalties of using full disk encryption in Ubuntu.

security

3 Answers

  1. It is supported at least since Karmic Koala on the amd64 architecture and since Natty Narwhal it is supported also on the i386 architecture.

    You can find that out by looking at the kernel configuration files found here. Search for the term CONFIG_CRYPTO_AES_NI_INTEL.

    • 5

  2. If your root partition is LUKS-encrypted you should add aesni-intel to /etc/initramfs-tools/modules (and run sudo update-initramfs -u -k all afterwards).

    Otherwise the module will be loaded too late in the boot process.

    • 4

  3. Block level kernel encryption (dm-crypt) already full supports AES-NI cryptographic acceleration.

    File level kernel encryption (eCryptfs) support for AES-NI was recently merged into the Linux upstream kernel tree, and should make its way into the Ubuntu kernel soon. Perhaps 13.10?

    • 2