How can I check if OpenSSL is support/use the Intel AES-NI?

A couple quick one liners built from the information provided by jww:

 openssl speed -elapsed -evp aes-128-cbc ... OPENSSL_ia32cap="~0x200000200000000" openssl speed -elapsed -evp aes-128-cbc ... 

Output of the first line should be significantly faster than the second. In my case on a i5 test machine, nearly double.

I made a Perl script (see below) that runs OpenSSL in default mode and with AES-NI explicitly disabled via an environment variable. It tests both CBC mode (earlier instructions like AESENC), and in GCM mode (later instructions such as PCLMULQDQ or VPCLMULQDQ). If the gain between the default mode of OpenSSL and the mode where AES-NI was explicitly disabled via an environment variable is more than 0% (on practice, should be at least 200%), than OpenSSL uses the new instructions. Here is a sample output of the script:

AES-CBC In default mode : 1641669.67k bytes/second, on average AES-CBC With AES-NI disabled : 448189.38k bytes/second, on average AES-CBC Gain : 266.29% AES-GCM In default mode : 4112319.92k bytes/second, on average AES-GCM With AES-NI disabled : 272767.79k bytes/second, on average AES-GCM Gain : 1407.63% 

I've tested the script on Windows, Linux and MacOS. On Windows, Perl is not installed by default, but you can download and install any Perl implementation, for example, Strawberry Perl. In Linux and MacOS, Perl should be already installed. For MacOS, later version of Perl can be installed by "brew install perl" and following the instructions given by this command; however, for my script, that later version of Perl is not needed.

Still, regardless of the operating system, this script uses an environment variable for Intel-compatible processors (x86/IA-32 or x86-64/IA-64). As such, this script will not give proper results on ARM processors, such as those used on Mac Mini M1, because it will be unable to enable/disable special AES instructions.

Still, your question is on how can you check whether OpenSSL supports/uses the Intel AES-NI. Therefore, your question is limited for Intel-compatible processors that are supposed to have Intel AES-NI instructions.

Here is the script:

#!/usr/bin/perl use strict; my $formatstr = 'The OpenSSL output does not match the regular expression.\nRegEx: %s\n---output begin---\n%s\n---output end---:'; my $regex_cbc = qr/^\s*AES-128-CBC\s+(\d+\.\d+)k\s+(\d+\.\d+)k\s+(\d+\.\d+)k\s+(\d+\.\d+)k\s+(\d+\.\d+)k\s+(\d+\.\d+)k\s*$/m; my $regex_gcm = qr/^\s*AES-128-GCM\s+(\d+\.\d+)k\s+(\d+\.\d+)k\s+(\d+\.\d+)k\s+(\d+\.\d+)k\s+(\d+\.\d+)k\s+(\d+\.\d+)k\s*$/m; my $command_cbc = 'openssl speed -elapsed -seconds 1 -evp aes-128-cbc'; my $command_gcm = 'openssl speed -elapsed -seconds 1 -evp aes-128-gcm'; my $env_var_name = 'OPENSSL_ia32cap'; my $env_var_value_disable_aes_ni = '~0x200000200000000'; # Test the CBC mode delete $ENV{$env_var_name}; print "Running OpenSSL for AES-128-CBC in default mode...\n"; sleep(1); # Cooldown for the CPU before the benchmark my $defaultrun_cbc = `$command_cbc`; chomp $defaultrun_cbc; print "Running OpenSSL for AES-128-CBC with AES-NI explicityly disabled...\n"; sleep(1); # Cooldown for the CPU before the benchmark $ENV{$env_var_name}=$env_var_value_disable_aes_ni; my $disabledrun_cbc = `$command_cbc`; chomp $disabledrun_cbc; # Test the GCM mode delete $ENV{$env_var_name}; print "Running OpenSSL for AES-128-GCM in default mode...\n"; sleep(1); # Cooldown for the CPU before the benchmark my $defaultrun_gcm = `$command_gcm`; chomp $defaultrun_gcm; print "Running OpenSSL for AES-128-GCM with AES-NI explicityly disabled...\n"; sleep(1); # Cooldown for the CPU before the benchmark $ENV{$env_var_name}=$env_var_value_disable_aes_ni; my $disabledrun_gcm = `$command_gcm`; chomp $disabledrun_gcm; # Calculate the results my $total_default_cbc; my $total_disabled_cbc; my $total_default_gcm; my $total_disabled_gcm; if ( $defaultrun_cbc =~ $regex_cbc ) {$total_default_cbc = ( $1 + $2 + $3 + $4 + $5 + $6 ) / 6;} else {die sprintf( $formatstr, $regex_cbc, $defaultrun_cbc );} if ( $disabledrun_cbc =~ $regex_cbc ) {$total_disabled_cbc = ( $1 + $2 + $3 + $4 + $5 + $6 ) / 6;} else {die sprintf( $formatstr, $regex_cbc, $disabledrun_cbc);} my $percentage_gain_cbc = 100 * ( $total_default_cbc - $total_disabled_cbc ) / $total_disabled_cbc; if ( $defaultrun_gcm =~ $regex_gcm ) {$total_default_gcm = ( $1 + $2 + $3 + $4 + $5 + $6 ) / 6;} else {die sprintf( $formatstr, $regex_gcm, $defaultrun_gcm );} if ( $disabledrun_gcm =~ $regex_gcm ) {$total_disabled_gcm = ( $1 + $2 + $3 + $4 + $5 + $6 ) / 6;} else {die sprintf( $formatstr, $regex_gcm, $disabledrun_gcm);} my $percentage_gain_gcm = 100 * ( $total_default_gcm - $total_disabled_gcm ) / $total_disabled_gcm; # Print the results print "\n\n"; print "AES-CBC In default mode : " . sprintf( "\%14.2f", $total_default_cbc ) . "k bytes/second, on average\n"; print "AES-CBC With AES-NI disabled : " . sprintf( "\%14.2f", $total_disabled_cbc ) . "k bytes/second, on average\n"; print "AES-CBC Gain : " . sprintf( "\%14.2f", $percentage_gain_cbc) . "%\n"; print "AES-GCM In default mode : " . sprintf( "\%14.2f", $total_default_gcm ) . "k bytes/second, on average\n"; print "AES-GCM With AES-NI disabled : " . sprintf( "\%14.2f", $total_disabled_gcm ) . "k bytes/second, on average\n"; print "AES-GCM Gain : " . sprintf( "\%14.2f", $percentage_gain_gcm) . "%\n";