Search code examples
opensslaes

Why does smaller blocksize lead to slower throughput for AES encryption?

I'm currently exploring the speed of AES for various configurations of block size and key size using:

openssl speed ALGORITHM

However I'm a little confused by the results (in the picture below and was hoping for an explanation. My 2 questions are:

  1. Why a smaller block size (especially for block size of 16 bytes) has such slower performance?
  2. How does block size affect security, does a block size of 16 bytes increase or decrease security?

Output of openssl speed for AES

Solution

  • First, you may be aware, but for other readers: "block size" here is not the block size of the algorithm. It refers to the size of the message being encrypted. The block size of AES is always 16 bytes.

    The overall throughput of the speed tool is the number of iterations it was able to complete times the block size.

    For each message, the speed tool creates a new AES session, which requires setting up a new key schedule. This is a somewhat expensive operation.

    This means that for very small messages, there are many very-short iterations, and so a lot of the time is spent in setting up the sessions (i.e. overhead). As the messages get longer, each iteration takes longer, but less of it is spent in overhead, so total bytes of throughput goes up.

    This doesn't really have much to do with the security of the system. AES is equally secure when encrypting short and long messages, all things being equal. (There are incorrect ways that AES can be used that might make short or long messages less secure, for example using a CTR session for so long that the counter repeats. But used correctly, the message size should have no impact on security.)