Thread: Re: [Ipsec-tools-devel] AES hardware acceleration
Brought to you by:
mit_warlord,
netbsd
From: Roman H. A. <rh...@op...> - 2012-07-24 12:02:20
|
>> I have an short Question about Raccon and Hardware Acceleration. >> >> Is it possible to use the AES Hardware Acceleration of an CPU with >> Racon? How can i enabled it / is it enabled by default? > > Racoon uses openssl to do encryption. If you have proper ENGINE module > for openssl installed and configured, encryption should be hardware > accelerated automatically. > > I use this constantly with Padlock. I also have openssl patches for > Padlock SHA acceleration. > > -Timo You are talking about IKE only. There is the GCM variant of AES for the Linux kernel, which is not yet supported by racoon. I am currently working on a patch for GCM, based on this mailing list post from 2009: http://marc.info/?l=ipsec-tools-devel&m=123606045019199 -Roman |
From: Timo T. <tim...@ik...> - 2012-07-24 12:13:07
|
On Tue, 24 Jul 2012 13:42:30 +0200 Roman Hoog Antink <rh...@op...> wrote: > >> I have an short Question about Raccon and Hardware Acceleration. > >> > >> Is it possible to use the AES Hardware Acceleration of an CPU with > >> Racon? How can i enabled it / is it enabled by default? > > > > Racoon uses openssl to do encryption. If you have proper ENGINE > > module for openssl installed and configured, encryption should be > > hardware accelerated automatically. > > > > I use this constantly with Padlock. I also have openssl patches for > > Padlock SHA acceleration. > > You are talking about IKE only. There is the GCM variant of AES for > the Linux kernel, which is not yet supported by racoon. I am currently > working on a patch for GCM, based on this mailing list post from 2009: > http://marc.info/?l=ipsec-tools-devel&m=123606045019199 Yes, racoon does only the IKE encryption. The phase2 encryption happens in-kernel and racoon is not involved there. Basically racoon tells kernel "for IPsec SA with SPI XXX, use encryption X with keys XXXX". Kernel then decides internally which crypto provider to use for it. Basically hardware acceleration will happen automatically if kernel supports your hardware device and is configured properly for it. -Timo |
From: Roman H. A. <rh...@op...> - 2012-07-24 14:01:21
|
On 24.07.2012 14:12, Timo Teras wrote: > On Tue, 24 Jul 2012 13:42:30 +0200 Roman Hoog Antink <rh...@op...> > wrote: > > [...] >> You are talking about IKE only. There is the GCM variant of AES for >> the Linux kernel, which is not yet supported by racoon. I am currently >> working on a patch for GCM, based on this mailing list post from 2009: >> http://marc.info/?l=ipsec-tools-devel&m=123606045019199 > > Yes, racoon does only the IKE encryption. The phase2 encryption happens > in-kernel and racoon is not involved there. Basically racoon tells > kernel "for IPsec SA with SPI XXX, use encryption X with keys XXXX". > > Kernel then decides internally which crypto provider to use for it. > Basically hardware acceleration will happen automatically if kernel > supports your hardware device and is configured properly for it. > > -Timo > I disagree a bit. In order to use GCM in the kernel, the two peers must negotiate one of those IPSEC algorithm IDs from RFC 4106 instead of the "standard" AES-CBC ID 12: 18 for AES-GCM with an 8 octet ICV 19 for AES-GCM with a 12 octet ICV 20 for AES-GCM with a 16 octet ICV Racoon does not know these IDs until now and I want to change that. -Roman |
From: Timo T. <tim...@ik...> - 2012-07-24 15:08:55
|
On Tue, 24 Jul 2012 16:01:08 +0200 Roman Hoog Antink <rh...@op...> wrote: > On 24.07.2012 14:12, Timo Teras wrote: > > On Tue, 24 Jul 2012 13:42:30 +0200 Roman Hoog Antink <rh...@op...> > > wrote: > > > > [...] > >> You are talking about IKE only. There is the GCM variant of AES for > >> the Linux kernel, which is not yet supported by racoon. I am > >> currently working on a patch for GCM, based on this mailing list > >> post from 2009: > >> http://marc.info/?l=ipsec-tools-devel&m=123606045019199 > > > > Yes, racoon does only the IKE encryption. The phase2 encryption > > happens in-kernel and racoon is not involved there. Basically > > racoon tells kernel "for IPsec SA with SPI XXX, use encryption X > > with keys XXXX". > > > > Kernel then decides internally which crypto provider to use for it. > > Basically hardware acceleration will happen automatically if kernel > > supports your hardware device and is configured properly for it. > > I disagree a bit. In order to use GCM in the kernel, the two peers > must negotiate one of those IPSEC algorithm IDs from RFC 4106 instead > of the "standard" AES-CBC ID 12: > > 18 for AES-GCM with an 8 octet ICV > 19 for AES-GCM with a 12 octet ICV > 20 for AES-GCM with a 16 octet ICV > > Racoon does not know these IDs until now and I want to change that. Uh. Yes, racoon knows the algorithm and key for the phase2. And communicates that detail to kernel. It is up to the kernel to decide *how* to do the encryption. Whether it will be hardware acceleration is up to kernel. Your question was about if hardware acceleration is used or not, right? For the IPsec-SA encryption, racoon has no part if the hardware encryption is enabled or not. - Timo |
From: VANHULLEBUS Y. <va...@fr...> - 2012-08-24 12:05:08
|
Hi. On Tue, Jul 24, 2012 at 01:42:30PM +0200, Roman Hoog Antink wrote: > >> I have an short Question about Raccon and Hardware Acceleration. > >> > >> Is it possible to use the AES Hardware Acceleration of an CPU with > >> Racon? How can i enabled it / is it enabled by default? > > > > Racoon uses openssl to do encryption. If you have proper ENGINE module > > for openssl installed and configured, encryption should be hardware > > accelerated automatically. > > > > I use this constantly with Padlock. I also have openssl patches for > > Padlock SHA acceleration. > > > > -Timo > > You are talking about IKE only. There is the GCM variant of AES for the > Linux kernel, which is not yet supported by racoon. I am currently > working on a patch for GCM, based on this mailing list post from 2009: > http://marc.info/?l=ipsec-tools-devel&m=123606045019199 I forgot to commit it, but we already have a patch to have racoon be able to negociate AES-GCM phase2, which has already been tested with a patched FreeBSD (FreeBSD patch should also be commited "soon"). I'll try to commit that on HEAD next week. Yvan. |
From: Roman H. A. <rh...@op...> - 2012-09-05 12:26:20
|
Hi Yvan No pressure, but could you please provide the patch? We desperately need it for gigabit speed operations. Cheers, Roman On 24.08.2012 13:49, VANHULLEBUS Yvan wrote: > Hi. > > On Tue, Jul 24, 2012 at 01:42:30PM +0200, Roman Hoog Antink wrote: >>>> I have an short Question about Raccon and Hardware Acceleration. >>>> >>>> Is it possible to use the AES Hardware Acceleration of an CPU with >>>> Racon? How can i enabled it / is it enabled by default? >>> >>> Racoon uses openssl to do encryption. If you have proper ENGINE module >>> for openssl installed and configured, encryption should be hardware >>> accelerated automatically. >>> >>> I use this constantly with Padlock. I also have openssl patches for >>> Padlock SHA acceleration. >>> >>> -Timo >> >> You are talking about IKE only. There is the GCM variant of AES for the >> Linux kernel, which is not yet supported by racoon. I am currently >> working on a patch for GCM, based on this mailing list post from 2009: >> http://marc.info/?l=ipsec-tools-devel&m=123606045019199 > > > I forgot to commit it, but we already have a patch to have racoon be > able to negociate AES-GCM phase2, which has already been tested with a > patched FreeBSD (FreeBSD patch should also be commited "soon"). > > > I'll try to commit that on HEAD next week. > > > Yvan. > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ > _______________________________________________ > Ipsec-tools-devel mailing list > Ips...@li... > https://lists.sourceforge.net/lists/listinfo/ipsec-tools-devel > -- Roman Hoog Antink Dipl. Ing. ETH Senior Security Engineer Open Systems AG Räffelstrasse 29 CH-8045 Zürich t: +41 44 455 74 00 f: +41 44 455 74 01 rh...@op... http://www.open.ch |
From: Roman H. A. <rh...@op...> - 2012-10-01 09:30:51
|
Ping... On 05.09.2012 14:26, Roman Hoog Antink wrote: > Hi Yvan > > No pressure, but could you please provide the patch? We desperately need > it for gigabit speed operations. > > Cheers, > Roman > > On 24.08.2012 13:49, VANHULLEBUS Yvan wrote: >> I forgot to commit it, but we already have a patch to have racoon be >> able to negociate AES-GCM phase2, which has already been tested with a >> patched FreeBSD (FreeBSD patch should also be commited "soon"). >> >> >> I'll try to commit that on HEAD next week. >> >> >> Yvan. |