Intel BX80623I72600K User manual

324952
Cryptographic
Performance on
the 2nd Generation
Intel® Core™
processor family
January 2011
White Paper
Vinodh Gopal
Jim Guilford
Wajdi Feghali
Erdinc Ozturk
Gil Wolrich
Kirk Yap
Sean Gulley
Martin Dixon
IA Architects
Intel Corporation

Cryptographic Performance on the
2nd Generation Intel® Core™ processor family
2
Executive Summary
The latest 2nd Generation Intel® Core™ processor family brings huge
performance increases to cryptographic applications.
Cryptographic algorithms consist of public and private key operations,
combined with secure hashing. We examine the performance of a small
representative set of algorithms on the new processors, and compare
with the performance of the Intel® microarchitecture code named
Westmere.
This paper describes the performance increase that can be achieved
on the 2nd Generation Intel® Core™ processor family over the Intel®
microarchitecture code named Westmere, on cryptographic
applications. We show the results on a small representative sample
set of algorithms optimized for performance on each processor. The
net result is an improvement in cryptographic performance up to
~1.8Xover the previous Intel processors1.
The Intel®Embedded Design Center provides qualified developers with
web-based access to technical resources. Access Intel Confidential design
materials, step-by step guidance, application reference solutions,
training, Intel’s tool loaner program, and connect with an e-help desk
1Software and workloads used in performance tests may have been optimized for performance
only on Intel microprocessors. Performance tests, such as SYSmark and MobileMark, are
measured using specific computer systems, components, software, operations and functions.
Any change to any of those factors may cause the results to vary. You should consult other
information and performance tests to assist you in fully evaluating your contemplated
purchases, including the performance of that product when combined with other products.
Configuration: Refer to the Performance section. For more information go to
http://www.intel.com/performance

Cryptographic Performance on the
2nd Generation Intel® Core™ processor family
3
and the embedded community. Design Fast. Design Smart. Get started
today. www.intel.com/embedded/edc.

Cryptographic Performance on the
2nd Generation Intel® Core™ processor family
4
Contents
Overview ................................................................................................................5
Improving Cryptographic Processing...........................................................................5
Multi-Buffer via SIMD .............................................................................6
Multi-Buffer via Data Dependency Hiding ..................................................6
Performance............................................................................................................7
Private-Key and Secure Hashing Performance............................................8
Public Key Encryption Performance...........................................................8
Conclusion ..............................................................................................................9
References ..............................................................................................................9

324952
Overview
Cryptographic algorithms, such as secure hashing or encryption, occur in
networking, storage and other applications. Since the amount of data being
processed is large and increasing at a rapid rate, there is an ever-increasing
need for very high performance implementations of these algorithms. The
Intel® microarchitecture code named Westmere is capable of excellent
performance as demonstrated in [2], [3] and [4]. However, the introduction
of the 2nd Generation Intel® Core™ processor family brings an additional
substantial boost in performance on cryptographic algorithms.
We examine the performance of a representative set of algorithms such as
modular exponentiation which forms the basis of most public key
cryptographic protocols, AES Encryption in the CBC Mode for
private/symmetric key encryption, and the MD5, SHA1, SHA256 secure
hashing algorithms for authentication. To compare the performance of an
algorithm on the processor families, we use the most optimized
implementation of that algorithm for each processor.
Improving Cryptographic Processing
Modular exponentiation forms the basis of almost all the prevalent public key
algorithms currently, such as the RSA, DSA and Diffie-Hellman algorithms. In
[3], we demonstrate the fastest implementation of modular exponentiation on
Intel processors. The 2nd Generation Intel® Core™ processor family improves
the performance of the multiply and adc (add with carry) instructions,
resulting in much faster modular exponentiation. Our implementation is a
constant-time one, safe from branch and cache based side-channel attacks,
and in [3] we demonstrate that our implementation is substantially faster on
Intel processors than the best-known publicly available implementation in
OpenSSL.
The hashing and private key encryption can be implemented using the multi-
buffer technique described in [4] for best performance on Intel processors.
There are two basic ways that processing multiple buffers in parallel can
improve performance: processing the buffers with SIMD instructions or
processing multiple buffers in parallel to reduce data dependency limits. In
[4], we describe how using multi-buffer techniques result in the best
performance for AES Encryption and the SHA1 secure hashing algorithm,
compared to the best single-buffer implementations. This is also the case for
the MD5 and SHA256 algorithms which are included in this study. In [4], we
describe a job scheduler to manage multiple buffers of varying sizes, for a
fully generalized solution to the multi-buffer problem for all usage models.

Cryptographic Performance on the
2nd Generation Intel® Core™ processor family
6
However, for simplicity, we use fixed-size small buffers without schedulers in
this paper, as we mainly focus on the performance improvements of the core
algorithms.
We did not include other algorithms in this study, as we believe the current
set is representative and forms the basis of the vast majority of cryptographic
protocols used today. Although other private key ciphers such as ARC4 and
DES are still used today, we anticipate the new AES algorithm will continue to
replace them in the future.
Multi-Buffer via SIMD
The Intel®64 and IA-32 instruction set architectures have two distinct
instruction subsets: general purpose instructions and Single Instruction
Multiple Data (SIMD) instructions [1]. SIMD instructions include, and are
mostly known as Intel®SSE (Streaming SIMD Extensions). These instructions
can be used to implement fast hashing for MD5, SHA1 and SHA256. As these
algorithms are defined on 32-bit words and perform a sequence of arithmetic
and logical operations, they are amenable to a SIMD approach where we can
process 4 independent buffers concurrently.
The 2nd Generation Intel® Core™ processor family improves the performance
of SIMD instructions with the introduction of the Intel® AVX (Intel®
Advanced Vector Extensions) instruction set [5], resulting in much faster
multi-buffer hashing. Although we process the same number of buffers as
with SSE, we gain some performance efficiency due to the more flexible
register operand definition of the AVX instruction set. Both our SSE and AVX
implementations operate on 128-bit data which consists of 4 data elements
from independent parallel buffers.
Multi-Buffer via Data Dependency Hiding
The Intel®AES-NI new instructions have been defined as a set of SSE
instructions, but are not SIMD. In particular the AESENC instruction, which
does one round of AES encryption, has a latency of several cycles. This means
that in some modes, such as counter-mode or CBC (Cipher Block Chaining)
decrypt, one can implement the algorithm such that multiple blocks of the
same buffer are being processed in parallel, but in the case of CBC-encrypt,
one cannot start encrypting a block until the previous block has been
encrypted. This means that CBC-encrypt requires a serial implementation,
where performance is limited by the latency rather than by the throughput.
However, if we can encrypt multiple independent buffers in parallel, we can
break the data dependencies and get ideal performance limited only by the
throughput for CBC-Encrypt. The 2nd Generation Intel® Core™ processor
family improves the throughput performance of the AES-NI instructions; to
realize this peak performance, we process 8 buffers in parallel. For the Intel

Cryptographic Performance on the
2nd Generation Intel® Core™ processor family
7
processors based on Intel® microarchitecture code named Westmere, we
maximize performance with 4 buffers.
Performance
The performance results provided in this section were measured on two
processors supporting Intel®AES-NI:
•Intel®Core™ i5-650 processor at a frequency of 3.20 GHz, based on
the Intel® microarchitecture code named Westmere
•Intel® Core™ i7-2600 processor at a frequency of 3.40 GHz, based on
the 2nd Generation Intel® Core™ processor family
The fact that the two processors have different clock frequencies does not
affect the comparison, as we have normalized the performance results to
cycles.
The tests, conducted by Intel, were run with Intel®Turbo Boost Technology
off, and represent the performance without Intel®Hyper-Threading
Technology (Intel®HT Technology) on a single core.
The multi-buffer code bases for AES, MD5, SHA1, SHA256 were measured on
64-byte fixed size data buffers without a scheduler. The AES-128 CBC Encrypt
implementation used pre-expanded keys. AES using 128-bit keys is a
common usage; the results will be similar and scale for other key sizes such
as 192 and 256 bit keys.
The modular exponentiation code bases were measured on 512-bit and 1024-
bit keys. These algorithms form the basis of one of the most critical Server
workloads, the RSA Signing Algorithm. RSA Sign performs a decryption
process that can be implemented efficiently with the Chinese Remainder
Theorem (CRT). As a result of the CRT implementation, RSA2048 requires
1024-bit modular exponentiation and RSA1024 requires 512-bit modular
exponentiation.
We present results here with warm data. When a test for warm data is called,
it is first run numerous times to warm up the cache.
The timing is measured using the rdtsc() function which returns the
processor time stamp counter (TSC). The TSC is the number of clock cycles
since the last reset. The ‘TSC_initial’ is the TSC recorded before the function
is called. Then, the function is called for the specified number of times for
data buffers of a given size. After the runs are complete, the rdtsc() is called
again to record the new cycle count ’TSC_final’. The effective cycle count for
the called routine is computed using
# of cycles = (TSC_final-TSC_initial)/(number of iterations).

Cryptographic Performance on the
2nd Generation Intel® Core™ processor family
8
Private-Key and Secure Hashing Performance
The multi-buffer performance is shown below in Table 1:
Table 1. Multi-Buffer Performance (Cycles/Byte)2
Algorithm i5-650 i7-2600 i7-2600 Gain
MD5 1.46 1.27 1.15
SHA1 2.96 2.2 1.35
SHA256 6.96 5.27 1.32
AES128-CBC-Encrypt 1.52 0.83 1.83
In all cases, we observe a large performance boost with the Intel® Core™ i7-
2600 processor based on the 2nd Generation Intel® Core™ processor family,
with gains ranging from 1.15-1.83X. The absolute performance is very
impressive as well, with 0.83 cycles/byte for AES128 and 2.2 cycles/byte
for SHA1.
Public Key Encryption Performance
The Public Key results are shown below in Table 2:
Table 2. Modular Exponentiation Performance (Cycles)2
Algorithm i5-650 i7-2600 i7-2600 Gain
512-bit Modular Exponentiation 360,880 246,899 1.46
1024-bit Modular Exponentiation 2,722,590 1,906,555 1.43
In this case, we observe a large performance boost with the Intel® Core™ i7-
2600 processor based on the 2nd Generation Intel® Core™ processor family of
~1.4X. The absolute performance of exponentiation is very impressive, with
just 246,899 cycles for a 512-bit constant-time modular exponentiation.
2Software and workloads used in performance tests may have been optimized for performance
only on Intel microprocessors. Performance tests, such as SYSmark and MobileMark, are
measured using specific computer systems, components, software, operations and functions.
Any change to any of those factors may cause the results to vary. You should consult other
information and performance tests to assist you in fully evaluating your contemplated
purchases, including the performance of that product when combined with other products.
Configuration: Refer to the Performance section. For more information go to
http://www.intel.com/performance

Cryptographic Performance on the
2nd Generation Intel® Core™ processor family
9
Conclusion
This paper describes the performance increase that can be achieved on the
2nd Generation Intel® Core™ processor family over the Intel®
microarchitecture code named Westmere, on cryptographic applications. We
show the results on a small representative sample set of algorithms. The net
result is an improvement in cryptographic performance up to ~1.8X3over the
previous Intel processors.
References
[1] Intel®64 and IA-32 Architectures Software Developer’s Manual Volume 1
[2] Breakthrough AES performance with Intel AES New Instructions
http://software.intel.com/file/26898
[3] Fast and Constant-time Implementation of Modular Exponentiation
http://www.cse.buffalo.edu/srds2009/escs2009_submission_Gopal.pdf
[4] Processing Multiple buffers in parallel
http://download.intel.com/design/intarch/papers/324101.pdf
[5] Intel AVX programming reference
http://softwarecommunity.intel.com/isn/downloads/intelavx/Intel-AVX-
Programming-Reference-31943302.pdf
The Intel®Embedded Design Center provides qualified developers with web-
based access to technical resources. Access Intel Confidential design
materials, step-by step guidance, application reference solutions, training,
Intel’s tool loaner program, and connect with an e-help desk and the
embedded community. Design Fast. Design Smart. Get started today.
http://intel.com/embedded/edc.
3Software and workloads used in performance tests may have been optimized for performance
only on Intel microprocessors. Performance tests, such as SYSmark and MobileMark, are
measured using specific computer systems, components, software, operations and functions.
Any change to any of those factors may cause the results to vary. You should consult other
information and performance tests to assist you in fully evaluating your contemplated
purchases, including the performance of that product when combined with other products.
Configuration: Refer to the Performance section. For more information go to
http://www.intel.com/performance

Cryptographic Performance on the
2nd Generation Intel® Core™ processor family
10
Authors
Vinodh Gopal, Jim Guilford, Erdinc Ozturk, Gil Wolrich,
Wajdi Feghali, Kirk Yap, Sean Gulley and Martin Dixon are
IA Architects with the IAG Group at Intel Corporation.
Acronyms
IA Intel®Architecture
API Application Programming Interface
SIMD Single Instruction Multiple Data
SSE Streaming SIMD Extensions