Description

AES-NI is supported by new CPUs which is able to encrypt/decrypt traffic faster than AES-CBC. This article explains how to enable it on NFX platform.

Symptoms

AES-NI is supported on Intel drivers, which boasts improved performance over AES-CBC.

From Intel's web site:

"The performance improvement expected with the use of AES-NI would depend on the applications and how much of the application time is spent in encryption and decryption. At the algorithm level, using AES-NI can provide significant speedup of AES. For non-parallel modes of AES operation such as CBC-encrypt AES-NI can provide a 2-3 fold gain in performance over a completely software approach. "

Solution

AES-NI is supported and enabled on all NFX platforms by default.  JDM has AES-NI support, and you can determine that by looking at the modules loaded on JDM:

root@jdm:~# lsmod | grep aesni
aesni_intel           144787  0
aes_x86_64              7753  1 aesni_intel
glue_helper             5426  1 aesni_intel
lrw                     4136  1 aesni_intel
ablk_helper             2596  1 aesni_intel
cryptd                  9675  2 aesni_intel,ablk_helper
root@jdm:~#