CTR vs CBC cycles per byte with OpenSSL EVP

Question

I did some benchmarking using the EVP calls of OpenSSL in C, for CBC and CTR encryption/decryption.

(1) : I got 3.2 Cycles/Byte for CBC encryption. (2) : I got 0.7 Cycles/Byte for CBC decryption, CTR encrypt, CTR decrypt.

How is it possible that I get 4 times less CPBs for CBC decrypt and CTR? (I know that (2) can be parallelized in theory.... but OpenSSL runs on a single thread in my benchmark). So how is it possible?

Answer 1

OpenSSL utilizes AES-NI instructions which are pipelineable. Note that CTR encryption and decryption and CBC decryption can all be computed in parallel, whereas CBC encryption is strictly sequential (you need the result of block $i$ in order to encrypt block $i+1$). Thus, CBC encryption cannot utilize the pipeline and you get 4+ times the running time. This is exactly as expected.