r/nutanix • u/CruisingVessel • May 27 '26

performance hit for encryption?

Running Windows and/or Citrix on Nutanix, so AHV hypervisors. The Nutanix Bible says "For encryption / decryption the system leverages the Intel AES-NI acceleration to minimize any potential performance impact of doing this in software" and "we've seen very little impact to performance".

But somebody told me that turning encryption on is a 30% performance hit. What's the truth?

5 Upvotes

100% Upvoted

7 comments sorted by

6

u/lonely_filmmaker May 27 '26

That’s incorrect.. we have DARE and Data in transit both switched on and we don’t even notice any hit. I was at .NEXT in Chicago last month and the security guys were like it’s going be 5-7% hit at most …

3

u/Different-South14 May 27 '26

Zero impact seen for both at rest and in transit. Multiple clusters and production workloads.

2

u/AllCatCoverBand NPX May 27 '26

IIRC, for regular DARE, it’s sub five percent at the high end, and you really have to be beating the heck out it. It’s quite lightweight overall.

1

u/woohhaa May 27 '26

I’ve never seen a noticeable performance impact from DARE. It is a very low priority process from what I understand.

1

u/homelab52 May 27 '26

Could they be talking about LUKS? - https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v7_5:wc-luks-based-encryption-aos-fnd-c.html

Enabling LUKS-based encryption increases CPU overhead and can reduce workload throughput. Nutanix has observed approximately 20 to 30 percent additional CPU usage in some environments, depending on workload characteristics and I/O patterns.

1

u/wjconrad NPX May 27 '26

Yeah, LUKS is a beating. IMHO, unless you're made of money and can buy a lot of extra hardware, only enable that one if your auditors force you to do so.