Changes between Version 2 and Version 3 of linux/crypto


Ignore:
Timestamp:
07/08/2019 10:00:05 PM (2 months ago)
Author:
Matthew Michilot
Comment:

Added instructions on how to build OpenSSL 1.1.1 and onward w/ AF_ALG and cryptodev support. Added performance metrics.

Legend:

Unmodified
Added
Removed
Modified
  • linux/crypto

    v2 v3  
    139139 * http://cryptodev-linux.org/
    140140
     141=== Performace Comparisons
     142* Device: GW6404-B
     143* CPU Speed: 1500 MHz
     144* OpenSSL version: 1.1.1c
     145
     146||                ||||||||||||= '''Number of Blocks Processed in 3s / Block Size in Bytes''' =||             
     147||= '''Engine''' =||16    ||64    ||256   ||1024   ||8192  ||16384|| 
     148||= AF_ALG       =||283925||281102||254300||212132 ||75834 ||43402||
     149||= cryptodev    =||958747||919563||674246||450026 ||107426||55976||
     150||= software     =||959704||920003||673949||4494228||107408||56336||
     151
     152Note: Performance of each engine may vary between systems. It's recommended to evaluate each engine on your system to determine their performance.
    141153
    142154[=#openssl]
     
    193205 * Use {{{-elapsed}}} and no {{{-engine}}} param to use software crypto to show wall-clock time vs CPU time
    194206
    195 
    196207[=#openssl-af_alg]
    197208=== OpenSSL with AF_ALG
     209==== Building OpenSSL prior to 1.1.0 with AF_ALG support
    198210OpenSSL added native AF_ALG support 1.1.0 (Aug 25 2016). If you are using a version prior to that you need to build a plugin for OpenSSL.
    199211
     
    217229sudo cp libaf_alg.so $DIR
    218230sudo chmod 644 $DIR/libaf_alg.so
    219 openssl engine # show engines available
    220231}}}
    221232 * Note that this plugin is incompatible with OpenSSL 1.1.x and will fail to build for those versions due to API changes
    222233
    223 Note that prior to OpenSSL 1.1.1 afalg is not enabled by default thus you need to rebuild it and add the 'enable-afalgeng' config option.
    224 
     234==== Building OpenSSL 1.1.0 and later with AF_ALG support
     235Note that prior to OpenSSL 1.1.1 AF_ALG support is not enabled by default thus you need to rebuild it and add the 'enable-afalgeng' config option.
     236{{{#!bash
     237apt install build-essential pkg-config libssl-dev
     238wget https://www.openssl.org/source/openssl-1.1.1c.tar.gz
     239tar xvf openssl-*
     240cd openssl-*
     241./config enable-engine enable-dso enable-afalgeng
     242make
     243make install
     244}}}
     245
     246Note that for Ubuntu / Debian Linux distros it is preferred to download source package, modify debian/rules and recompile the package:
     247{{{#!bash
     248apt install build-essential pkg-config ubuntu-dev-tools debhelper
     249apt-get build-dep openssl
     250apt-get source openssl
     251cd openssl-*/
     252sed -i "s/CONFARGS  =/CONFARGS  = enable-engine enable-dso enable-afalgeng/" debian/rules
     253dch -i "Enabled AF_ALG support"
     254debuild
     255sudo dpkg -i ../*.deb
     256}}}
     257
     258==== Enabling the AF_ALG kernel module
    225259To ensure you are loading the kernel modules (af_alg, algif_hash, algif_skcipher):
    226260 * load them on boot:
     
    237271}}}
    238272
    239 OpenSSL performance can be tested with:
    240 {{{#!bash
    241 openssl engine # ensure af_alg is present
     273==== Checking AF_ALG engine installation
     274
     275On OpenSSL versions prior to 1.1.0, you can check if the AF_ALG engine was successfully installed by running the following command:
     276{{{#!bash
     277openssl engine # check if af_alg is present
     278}}}
     279
     280On OpenSSL versions 1.1.0 and later, the AF_ALG engine is dynamically loaded which means that the engine will not appear when you run the command above.
     281
     282==== Evaluating AF_ALG performance
     283For OpenSSL versions prior to 1.1.0:
     284{{{#!bash
    242285openssl speed -evp aes-128-cbc -engine af_alg -elapsed
    243286}}}
    244287
     288For OpenSSL versions 1.1.0 and later:
     289{{{#!bash
     290openssl speed -evp aes-128-cbc -engine afalg -elapsed
     291}}}
    245292
    246293[=#openssl-crytodev]
    247294=== OpenSSL with cryptodev
     295==== Building OpenSSL versions prior to 1.1.1 with cryptodev support
    248296Because Cryptodev is not available by default on Linux distributions OpenSSL has to be compiled with additional flags to include support for them:
    249297{{{#!bash
     
    264312apt-get source openssl
    265313cd openssl-*/
    266 sed -i -e "s/CONFARGS  =/CONFARGS = -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS/" debian/rules
     314sed -i "s/CONFARGS  =/CONFARGS = -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS/" debian/rules
    267315dch -i "Enabled cryptodev support"
    268316DEB_BUILD_OPTIONS=nocheck debuild # disable checks to avoid issue with api check failing
     
    270318}}}
    271319
     320==== Building OpenSSL versions 1.1.1 and later with cryptodev support
     321Starting with version 1.1.1, the cryptodev engine is now called devcrypto and is implemented against the cryptodev-linux kernel module. To build OpenSSL with devcrypto support, the 'enable-devcryptoeng' flag is used during configuration.
     322
     323{{{#!bash
     324apt install build-essential pkg-config
     325wget https://www.openssl.org/source/openssl-1.1.1c.tar.gz
     326tar xvf openssl-*
     327cd openssl-*
     328./config enable-engine enable-dso enable-devcryptoeng
     329make
     330make install
     331}}}
     332
     333For Ubuntu / Debian Linux distros:
     334{{{#!bash
     335apt install build-essential pkg-config ubuntu-dev-tools debhelper
     336apt-get build-dep openssl
     337apt-get source openssl
     338cd openssl-*/
     339sed -i "s/CONFARGS  =/CONFARGS = enable-engine enable-dso enable-devcryptoeng/" debian/rules
     340dch -i "Enabled cryptodev support"
     341debuild # disable checks to avoid issue with api check failing
     342sudo dpkg -i ../*.deb
     343}}}
     344
     345==== Enabling the cryptodev kernel module
    272346To ensure you are loading the kernel module (cryptodev):
    273347 * load them on boot:
     
    282356}}}
    283357
    284 OpenSSL Testing:
     358==== Checking cryptodev engine installation
     359
     360For OpenSSL versions prior to 1.1.1:
    285361{{{#!bash
    286362openssl engine # show engines available - look for cryptodev
     
    288364}}}
    289365
     366For OpenSSL versions 1.1.1 and later:
     367{{{#!bash
     368openssl engine # look for devcrypto
     369}}}
     370
     371==== Evaluating cryptodev performance
    290372OpenSSL performance can be tested with the 'openssl speed' command:
     373
     374For OpenSSL versions prior to 1.1.1
    291375{{{#!bash
    292376openssl speed -evp aes-128-cbc -engine cryptodev -elapsed
    293377}}}
    294  * -elapsed argument is used so throughput measurements are against wall clock time rather than cpu time
     378
     379For OpenSSL versions 1.1.1 and later
     380{{{#!bash
     381openssl speed -evp aes-128-cbc -engine devcrypto -elapsed
     382}}}
    295383
    296384References: