Calculate the bandwidth and latency overhead added by encrypting network traffic.
Encryption overhead is primarily a function of cipher throughput: how many bytes per second the CPU can encrypt. Hardware-accelerated AES (via AES-NI instructions found on virtually all modern x86 CPUs) can exceed 10 GB/s, while a software-only AES implementation without that acceleration is roughly 20x slower, around 500 MB/s. ChaCha20 was specifically designed to run fast in pure software (using standard ALU operations rather than needing dedicated hardware), which is why it's often preferred on mobile/ARM devices lacking AES hardware support.
Encryption time
encryption_time = data_size / throughput
AES-NI is a set of dedicated CPU instructions that perform AES round operations directly in hardware, avoiding the many software lookup-table operations a pure-software implementation needs. This typically yields a 10-20x speedup over software-only AES.
ChaCha20 was designed using only additions, rotations, and XORs — operations any CPU handles efficiently — so it doesn't rely on specialized hardware to be fast. On devices without AES-NI (many older or lower-power ARM chips), ChaCha20 can outperform software AES.
Only slightly — AES-256 uses 14 encryption rounds versus AES-128's 10, so it's roughly 40% more computational work per block, not the doubling its key-length name might suggest. Hardware acceleration narrows this gap further.
Rarely on modern hardware with acceleration enabled — a single core can often out-encrypt a 10 Gbps link. It becomes a real bottleneck mainly on constrained embedded devices, older CPUs without AES-NI, or when encrypting/decrypting at very high aggregate rates across many simultaneous connections.