Linux Encryption Performance is Not an Excuse Anymore
summary
Recent Linux work shrinks encryption costs: enabling larger device-mapper sectors cuts dm-crypt overhead from ~20% to ~8% on IBM Z, dm-crypt remains transparent to apps, Postgres tests show ~5% throughput loss, TLS 1.3 reduces handshake bytes and yields ~6–15% faster connections, Curve25519 shows up to ~14x speed in some JWT benchmarks, GCM often outperforms CBC by up to 3x and Z14 reports ~12x GCM gains, and common measurement tools are fio and sar/tsar while practical change is dm-crypt sector-size change and TLS 1.3 + Curve25519.
AI-written summary · about
chapters (14)
- 0:00Linux Encryption Performance is not an Excuse Anymore
- 2:58Data breaches
- 7:43Best practices
- 9:09Why should we do it?
- 11:04Why are we still not doing it?
- 13:01Low-cost Encryption Marketing
- 14:48Different levels of encryption in Linux
- 18:00TLS v1.3
- 23:45TLS symmetric data encryption AES moving from CBC to CCM mode - authenticated encryption
- 24:57Vendors improve encryption performance
- 28:21dm-crypt performance
- 32:13Android encryption - Google Adiantum
- 33:45Intel HW - Xeon Scalable example Intel® QuickAssist Technology
- 34:13What the future holds
related talks
27mSpeeding Up Linux Disk Encryption
29mSecuring Data in Motion and at Rest: Quantifying End-to-End Encryption Perfo...
41mCryptographic speed, reliability & security
30mFacing Extinction: The Fight To Keep Hardware Crypto Engines in Embedded Linux
29mAre Our Systems Using up-to-Date Cryptography?
20mmmTLS: Scaling the Performance of Encrypted Network Traffic Inspection
42mCryptography Support in Zephyr: Recent Changes and Upcomings
30mEncrypting Memory at Scale