Please enable AESNI support via the --enable-aesni flag.

AES must be accelerated to run strongSwan at acceptable speeds on very
low resourced cloud providers. strongSwan includes support for
specialized CPU instructions available on most x86 and amd64
processors to accelerate AES. This feature is only used if the
supported CPU instructions are present.

Enabling this feature will help a larger population of users to take
advantage of strong crypto to protect their communications.

This feature must be enabled via the --enable-aesni configuration option [1]:
--enable-aesni
enable Intel AES-NI crypto plugin [ no ]. Since 5.3.1.

This is the official description of the feature [2]:
The new aesni plugin provides CBC, CTR, XCBC, CMAC, CCM and GCM crypto
primitives for AES-128/192/256. The plugin requires AES-NI and PCLMULQDQ
instructions and works on both x86 and x64 architectures. It provides
superior crypto performance in userland without any external libraries.

[1] https://wiki.strongswan.org/projects/strongswan/wiki/Autoconf
[2] https://wiki.strongswan.org/versions/56

Thanks!

We don't enable libipsec so it doesn't really matter actually, AES is done in
the kernel, which does suppor AES-NI.

Regards,

Control: fixed -1 5.3.5-2

I think there may be some confusion.  Dan Guido reported this bug
against version 5.5.1-2, but perhaps he meant to report the bug against
jessie or earlier versions (e.g. 5.2.1-6).  Yves-Alexis Perez enabled
aesni in alioth commit 8e32f50ac¹, package version 5.3.5-2, which
entered sid² and stretch³ in March 2016, about eight months before the
report.

Also Yves-Alexis Perez mentions this plugin is ineffective without the
libipsec backend, but I believe there may be some confusion here too.
My understanding is that IKE is handled in userland by whatever plugins
are loaded, whereas ESP is handled in kernel, ignoring plugins
(essentially restricted to whatever af-alg supports).  Particularly true
if libstrongswan-standard-plugins is installed (containing aesni) and
libstrongswan-extra-plugins is *not* installed (containing af-alg).

¹ https://anonscm.debian.org/cgit/pkg-swan/strongswan.git/commit/?id=8e32f50ac2c90358c14cd36753aa360e8d80ccab
² https://packages.qa.debian.org/s/strongswan/news/20160317T140101Z.html
³ https://packages.qa.debian.org/s/strongswan/news/20160323T163916Z.html