29 June 2020

Performance Impact of ZFS Encryption on Oracle Solaris

Transparent Encryption is very easy to use on Oracle Solaris.
You just need to set the encryption property when you create a new filesystem and provide a passphrase or keyfile.

On a SPARC S7 LDom we have 3 ZFS filesystems with different encryption settings.

# zfs get encryption v0123_db/plain v0123_db/encr v0123_db/encr256
NAME              PROPERTY    VALUE        SOURCE
v0123_db/encr     encryption  on           local
v0123_db/encr256  encryption  aes-256-ccm  local
v0123_db/plain    encryption  off          -

Now lets see how much is the difference in write performance if we copy a 1 GB file.

# ls -lh p25604852_1100_Solaris86-64_1of4.zip
-rw-r--r--   1 marcel   staff       1.3G Apr  7  2017 p25604852_1100_Solaris86-64_1of4.zip
#

# time cp p25604852_1100_Solaris86-64_1of4.zip /plain

real    0m8.829s
user    0m0.002s
sys     0m1.711s

# time cp p25604852_1100_Solaris86-64_1of4.zip /encr

real    0m9.229s
user    0m0.002s
sys     0m1.747s

# time cp p25604852_1100_Solaris86-64_1of4.zip /encr256

real    0m9.733s
user    0m0.002s
sys     0m1.754s

The difference is a low one digit percent value.

Performance impact is a little larger when doing a simple read test.

# time cp /plain/p25604852_1100_Solaris86-64_1of4.zip /tmp

real    0m4.216s
user    0m0.002s
sys     0m3.810s

# time cp /encr/p25604852_1100_Solaris86-64_1of4.zip /tmp

real    0m5.131s
user    0m0.003s
sys     0m5.028s

# time cp /encr256/p25604852_1100_Solaris86-64_1of4.zip /tmp

real    0m5.400s
user    0m0.003s
sys     0m5.287s

Learn more about ZFS encryption with the Oracle Solaris 11.4 ZFS Admin Guide

https://docs.oracle.com/cd/E37838_01/html/E61017/gkkih.html