The Intel Advanced Encryption Standard (AES) or New Instructions (AES-NI) engine enables high-speed hardware encryption and decryption for OpenSSL, ssh, VPN, Linux/Unix/OSX full disk encryption and more. How do I check support for Intel or AMD AES-NI loaded in my running Linux in my Linux based system including OpenSSL?

The Advanced Encryption Standard Instruction Set and the Intel Advanced Encryption Standard New Instructions allows specific Intel/AMD and other CPUs to do extremely fast hardware encryption and decryption.
Please note that the AES-NI support is automatically enabled if the detected processor is among the supported list as above. For a list of processors that support the AES-NI engine, see Intel ARK/AMD/ARM (vendor)/VIA padlock site and documentation. The AES-NI is an extension to the x86 instruction set architecture for microprocessors from Intel and AMD. It increases the speed of apps performing encryption and decryption using the AES. Several server and laptop vendors have shipped BIOS configurations with the AES-NI extension disabled. This page shows you how to check that your CPU supports AES-NI on Linux. You may need a BIOS update to enable AES/AES-NI or change the BIOS settings. The following CPUs are supported:

  1. Intel Westmere/Westmere-EP (Xeon 56xx)/Clarkdale (except Core i3, Pentium and Celeron)/Arrandale(except Celeron, Pentium, Core i3, Core i5-4XXM).
  2. Intel Sandy Bridge cpus (except Pentium, Celeron, Core i3).
  3. Intel mobile Core i7 and Core i5.
  4. Intel Ivy Bridge processors All i5, i7, Xeon and i3-2115C only.
  5. Intel Haswell processors (all except i3-4000m, Pentium and Celeron).
  6. Intel Coffee Lake/Kaby Lake and so on
  7. AMD Bulldozer/Piledriver/Steamroller/Jaguar/Puma/Ryzen-based processors.
  8. AMD Geode LX processors.
  9. VIA PadLock (a different instruction set than Intel AES-NI but does the same thing at the end of the day).
  10. ARM – selected Allwinner and Broadcom using security processor. There are few more ARM based processor.

How to find out AES-NI (Advanced Encryption) Enabled on Linux System

One can find out that the processor has the AES/AES-NI instruction set using the lscpu command:
# lscpu
Type the following command to make sure that the processor has the AES instruction set and enabled in the BIOS:
# grep -o aes /proc/cpuinfo
# grep -m1 -o aes /proc/cpuinfo
Sample outputs:

Fig.01: How to find out AES-NI (Advanced Encryption) Enabled on Linux System

Fig.01: Linux Verify That Processor/CPU Has the AES-NI Instruction

The aes output indicates that I have the AES-NI support enabled by Linux.

Check if AES-NI is enabled on Linux with cpuid

Another option is to use the cpuid command:
# cpuid | grep -i aes | sort | uniq
Sample outputs:

 AES instruction                         = true

How do I verify that all my CPU supports AES NI?

The output of the following two commands should be same:
# lscpu | grep '^CPU(s):'

# grep -o aes /proc/cpuinfo | wc -l

Is Intel AES-NI instructions optimized driver loaded for my Linux server/laptop/desktop?

Type the following command to check for AES-NI support on your processor:
# sort -u /proc/crypto | grep module
Sample outputs:

module       : aesni_intel
module       : aes_x86_64
module       : crc32_pclmul
module       : crct10dif_pclmul
module       : ghash_clmulni_intel
module       : kernel

Is Intel AES-NI enabled for openssl enabled?

Now that we have verified support, it’s time to test it. Is my AES-NI/VIA padlock engine supported?
$ openssl engine
Sample outputs from VIA based cpu that supports the AES:

(padlock) VIA PadLock (no-RNG, no-ACE)
(dynamic) Dynamic engine loading support

Another output from Intel based system that support the AES-NI:
$ openssl engine
(aesni) Intel AES-NI engine
(dynamic) Dynamic engine loading support

Test: AES-NI CPU vs Normal CPU without the AES-NI/Packlock support

In this example, serverA has the AES-NI and serverB has no support for hardware encryption:
$ dd if=/dev/zero count=1000 bs=1M | ssh -l vivek -c aes128-cbc serverA "cat >/dev/null"
1000+0 records in
1000+0 records out
1048576000 bytes (1.0 GB) copied, 10.6691 s, 98.3 MB/s

$ dd if=/dev/zero count=1000 bs=1M | ssh -l vivek -c aes128-cbc serverB "cat >/dev/null"
vivek@localhost's password:
1000+0 records in
1000+0 records out
1048576000 bytes (1.0 GB) copied, 31.6675 s, 33.1 MB/s

Test: How do I benchmark my openssl performance?

Again run the following commands on both the systems:
$ openssl speed
$ openssl speed aes-128-cbc
For latest version of openssl, try the following two commands (the 2nd command should have higher ‘numbers’ than first (thanks EntropyZer0):
$ openssl speed aes-256-cbc
$ openssl speed -evp aes-256-cbc

Popular Linux or Unix/BSD applications that can benefit from the AES-NI from high speed ecryption/decryption

  • dm-crypt for full-disk encryption on Linux.
  • 7-Zip app.
  • Google chrome and firefox browsers
  • FreeBSD’s OpenCrypto API i.e aesni driver for zfs and other file systems.
  • OpenSSL 1.0.1 and above.
  • TrueCrypt 7.0 and above or VeraCrypt.
  • Citrix XenClient 1.0 and above.
  • Compilers such as GCC 4.4+, Intel C/C++ compiler 11.1+, Clang 3.3+ and more.
  • Libraries for golang, java, NSS, openssl and more.
  • Linux and BSD firewalls and vpn especially easy to use pfsense, ipcop and more.
  • Operating system based on Linux, *BSD, Unix, Microsoft, Android, iOS, Apple OS X and more.

🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 4 comments so far... add one

CategoryList of Unix and Linux commands
Disk space analyzersdf ncdu pydf
File Managementcat tree
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
4 comments… add one
  • EntropyZer0 Dec 11, 2015 @ 20:28

    It seems like you’re running an outdated version of openssl:

    Apparently, since 1.0.1 openssl doesn’t need a specific engine anymore to use the AES-NI-instructions; it has native support via evp

    To test for AES-NI support in openssl 1.0.1 and newer, simply compare the output of these commands:
    $ openssl speed aes-256-cbc
    $ openssl speed -evp aes-256-cbc

    Second one should have considerably higher ‘numbers’ than first (for me it’s around x3 for larger blocks and up to nearly x6 for the smaller ones)

    • Zta May 11, 2016 @ 22:12

      What’s -evp? Can’t find it in the man page…

  • Srgio Pimenta Sep 27, 2016 @ 14:40

    Very helpfull article! Very clear! This is very important because if you have an processor with AES Instruction set but doesn’t benefit from it is wastefull…

  • Hans-Jrgen Petrich Jan 9, 2017 @ 12:13

    i use:

    #without AES-NI
    OPENSSL_ia32cap="~0x200000200000000" openssl speed -elapsed -evp aes-128-ecb

    # with AES-NI (if supported)
    openssl speed -elapsed -evp aes-128-ecb

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum