Re: [Ocf-linux-users] Key accelerator support in OCF.

[Kennedy, B. <bre...@in...>]

Hi All,

There is an example of PKE related acceleration code in the 'ep80579' directory of the OCF release (see icp_common.c and icp_asym.c). It implements each of the OCF supported algorithms.

As an aside, for DSA verify, I attach a 2 patches for your appraisal. For OCF, the patch allows a verification failure (i.e. due to bad keys) to be treated separately from a process failure. The OpenSSL engine patch is required because openssl seems to take '1' as success, whereas OCF returns 0 for success.

Regards,
Brendan

OCF 20080917 patch:

--- ocf-linux/ocf/cryptodev.c   2007-12-14 02:35:04.000000000 +0000
+++ ocf-linux/ocf/cryptodev.c   2009-04-07 18:55:22.390311000 +0100
@@ -486,7 +486,6 @@ cryptodev_key(struct crypt_kop *kop)

        kop->crk_crid = krp->krp_crid;          /* device that did the work */
        if (krp->krp_status != 0) {
-               error = krp->krp_status;
                goto fail;
        }


OpenSSL 0.9.8e or g eng_cryptodev.c patch:

--- openssl/crypto/engine/eng_cryptodev.c       2008-12-03 14:21:46.000000000 +0000
+++ openssl.working/crypto/engine/eng_cryptodev.c       2008-12-02 18:32:47.000000000 +0000
@@ -1215,7 +1216,8 @@ cryptodev_dsa_verify(const unsigned char
        kop.crk_iparams = 7;

        if (cryptodev_asym(&kop, 0, NULL, 0, NULL) == 0) {
-               dsaret = kop.crk_status;
+/*OCF success value is 0, if not zero, change dsaret to fail*/
+               if(0 != kop.crk_status) dsaret  = 0;
        } else {
                const DSA_METHOD *meth = DSA_OpenSSL();




-----Original Message-----
From: David McCullough [mailto:Dav...@se...] 
Sent: 08 May 2009 01:05
To: anj...@mi...
Cc: ocf...@li...
Subject: Re: [Ocf-linux-users] Key accelerator support in OCF.


Jivin anj...@mi... lays it down ...
> Hi,
> I am developing OCF driver for the hardware which can off-load different 
> mathematical operations like "mod exponentiation", "mod mult", "mod inv", 
> etc...
> I see only "modular expo" can be off-loaded with current OCF frame work. 

Sorry for not replying earlier,  just spotted this in my inbox.

Currently there are examples/implementations of doing:

	MOD_EXP
	MOD_EXP_CRT

and rudimentary support for:

	DSA_SIGN
	DSA_VERIFY
	DH_COMPUTE_KEY

> Is there any support to off-load other math operations?
> With the current OCF frame work what all mathematical operations can be 
> off-loaded to hardware.

The API for the "math" like functions is pretty generic, you should be able
to easily add any operations you like really.

Basically you pass in a list of input/output params and the impementations
know what each param is for.

I have seen a driver that implemented much more than just the MOD_EXP,
can't recall any details of it though :-(

Cheers,
Davidm

-- 
David McCullough,  dav...@se...,  Ph:+61 734352815
McAfee - SnapGear  http://www.snapgear.com                http://www.uCdot.org

------------------------------------------------------------------------------
The NEW KODAK i700 Series Scanners deliver under ANY circumstances! Your
production scanning environment may not be a perfect world - but thanks to
Kodak, there's a perfect scanner to get the job done! With the NEW KODAK i700
Series Scanner you'll get full speed at 300 dpi even with all image 
processing features enabled. http://p.sf.net/sfu/kodak-com
_______________________________________________
Ocf-linux-users mailing list
Ocf...@li...
https://lists.sourceforge.net/lists/listinfo/ocf-linux-users
---------------------------------------------------------------------
Intel Shannon Limited
Registered in Ireland
Registered Office: One Spencer Dock, North Wall Quay, Dublin 1
Registered Number: 308263
Business address: Dromore House, East Park, Shannon, Co. Clare

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.