Home > Storage > ObjectScale and ECS > Product Documentation > Dell ECS: Data at Rest Encryption > Performance
From the data path perspective, every read/write path for system-encrypted objects incurs some extra cycles because we now have to obtain the virtual wrapping key. Previously, the bucket key was used as the wrapping key. Now, the virtual wrapping key derived from bucket key and rotation key is used. The rotation key is cached after the first call to get it and is available to all reads/writes after that. Also, the bucket key will likely be available in the cache (this behavior has not changed). Practically, the step to derive the virtual wrapping key from the bucket and rotation key is the extra performance penalty incurred during reads/writes. It results in an approximately 10 percent performance penalty on S3 TPS when D@RE is enabled.
Note: For more information about the ECS performance, see the ECS performance paper. The paper is internal only and can be shared with partners and customers under NDA.