IPSec AH hardware offload
Hi,
I'm currently developing a driver for a hardware crypto offload engine that is capable of offloading both ESP and AH in IPSec. I've noticed that none of the crypto drivers in 2.6.28 do offload for ahash and that the netkey AH implementation both use synchronous hashes. Are the synchronous software versions likely to be more efficient than hardware offloading or is there an architectural reason for not using async hashes?
Cheers,
Jamie
This email and any files transmitted with it are confidential and intended solely for the use of the individuals to whom they are addressed. If you have received this email in error please notify the sender and delete the message from your system immediately.
Herbert Xu
maintainerQuoted 7 lines · Jamie Iles
I'm currently developing a driver for a hardware crypto offload engine that is capable of offloading both ESP and AH in IPSec. I've noticed that none of the crypto drivers in 2.6.28 do offload for ahash and that the netkey AH implementation both use synchronous hashes. Are the synchronous software versions likely to be more efficient than hardware offloading or is there an architectural reason for not using async hashes?
No it's just because nobody has gotten around to complete the async hash work yet. So we're currently half-way through the process of converting existing algorithms to the shash interface, which allows them to be used efficiently by IPsec through the ahash interface.
Once that's completed we can then convert IPsec (or rather, authenc) over to using ahash.
Cheers,
Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txtQuoted 2 lines · Herbert Xu
Once that's completed we can then convert IPsec (or rather, authenc) over to using ahash.
Does that include the hash for authentication header in net/ipv[46]/ah[46].c?
The driver implements authenc algorithms, so we'll already get asynchronous operation for ESP, but the crypto_alloc_hash() in ah[46].c explicitly requests a synchronous hash. Is this worth converting to use ahash?
Thanks,
Jamie
Herbert Xu
maintainerQuoted 3 lines · Jamie Iles
Does that include the hash for authentication header in net/ipv[46]/ah[46].c?
Yes.
Quoted 4 lines
The driver implements authenc algorithms, so we'll already get asynchronous operation for ESP, but the
crypto_alloc_hash()in ah[46].c explicitly requests a synchronous hash. Is this worth converting to use ahash?
Whether it's worth it depends on how much you're being paid :) But it certainly wouldn't hurt, provided that someone is willing to do the work.
Cheers,
Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt