AES-NI support

[hazcod]

Is it possible to enable hardware acceleration?
I see high CPU usage when doing large files.

[benrubson]

Hello,

Yes, I would also be glad to see AES-NI / hardware acceleration into EncFS !
Especially on FreeBSD.
Sounds like OpenCrypto framework could be used for this purpose as AES-NI is already implemented there.

Thank you very much !

Ben

[vgough]

This should already be supported via OpenSSL's engine support:

https://github.com/vgough/encfs/blob/master/encfs/openssl.cpp#L75

At one time, I recall having to set global openssl configuration to enable the AES-NI hardware engine. I don't know if that's still necessary, or if OpenSSL is supposed to auto-detect.

[benrubson]

Thank you for your feedback vgough !

According to this link, EVP_* methods must be used to activate AES-NI.
Is it the case ?

Perhaps it could be a good idea to add an EncFS option to show AES-NI status ?
Test seems to be easy according to the previous link.

# encfs --help
(...)
encfs --aesni     will return yes or no whether AES-NI is available / activated or not.

Thank you very much !

Ben

[hazcod]

@benrubson Maybe it does, I see following line in

encfs/ChangeLog

Line 1265 in 340fefd

check for various OpenSSL EVP_* functions

[mcronce]

It definitely looks like EVP functions are being used, at least in some places.

EDIT: Removed ridiculously long grep output. Suffice to say a grep for EVP suggests they're being used :)

[benrubson]

Yes having a closed look at the code, sounds like EVP_* functions are used.

In addition, according to this link, would be "useless" to make a function telling that AES-NI is supported, the main thing being to use the correct functions in the code itself.

We then first have to be sure that AES-NI functions are used everywhere in the code (developper confirmation needed).
Then a function/option could be implemented to tell whether or not AES-NI is supported on the current hardware, but simply looking at the CPU embedded functions will tell it.

[veeara282]

Maybe a good alternative for computers that don't have AES-NI would be a GPU implementation.

[benrubson]

I think we can now close this. Thx !