kanotix.com

Hardware - VIA C-7 / nano padlock crypto hw support in Hellfire

mai77 - 08.05.2011, 12:08 Uhr
Titel: VIA C-7 / nano padlock crypto hw support in Hellfire
in kanotix Hellfire liveCD padlock support is somewhat working.
you should in a live-usb-stick asf., however, manually still type this:


modprobe via-rng
modprobe padlock-sha
modprobe padlock-aes

apt-get install rng-tools

openssl engine


/etc/init.d/rng-tools restart
Starting Hardware RNG entropy gatherer daemon: rngd.

RNG = hw random # gen works Winken

openssl in hellfire 2.6.38 or even 2.6.39 rc6 has no hw RNG:

(padlock) VIA PadLock (no-RNG, ACE)
(dynamic) Dynamic engine loading support

if you have a hd inst instead of the live-stick add
via-rng
padlock-sha
padlock-aes

to /etc/modules

/var/log/dmesg says in hellfire 2.6.39 rc 32bit :
CPU0: Centaur VIA C7-M Processor 1000MHz stepping 00
VIA RNG detected
padlock_aes: Using VIA PadLock ACE for AES algorithm.
padlock_sha: Using VIA PadLock ACE for SHA1/SHA256 algorithms.



make sure,
/etc/ssl/openssl.conf
reads sth. like

Code:
# Extra OBJECT IDENTIFIER info:
#oid_file               = $ENV::HOME/.oid
oid_section             = new_oids

openssl_conf = openssl_def

[openssl_def]
engines = openssl_engines

[openssl_engines]
padlock = padlock_engine

[padlock_engine]
default_algorithms = ALL


then still no hw rng in openssl, though.
http://ubuntuforums.org/showthread.php?t=710243

but:

openssl speed -evp aes-128-cbc -engine padlock
Code:
type             16 bytes     64 bytes    256 bytes    1024 bytes   8192 bytes
aes-128-cbc      38405.92k    98045.05k   160549.25k   206029.15k   238508.25k


without -evp it is 200 times slower, since padlock it is fact not used (bug)

openssl speed aes-128-cbc -engine padlock
Code:
type             16 bytes     64 bytes     256 bytes    1024 bytes   8192 bytes
aes-128 cbc      10621.45k    13814.63k    14946.27k    15269.76k    15177.01k



maybe the kernel was compiled to not support VIA nano padlock module or something. see:

http://www.grounation.org/index.php?post/2008/07/02/6-via-c7-padlock-on-debian-etch






To see if your OpenSSL build has PadLock support, run this simple command:

this is what you would LIKE to see:

$ openssl engine padlock
(padlock) VIA PadLock (RNG, ACE)

If instead of (RNG, ACE) you see (no-RNG, no-ACE), it means that your OpenSSL installation is PadLock-ready, but your processor is not. You also could see an ugly error message saying that there is no such engine. In that case, you should upgrade or patch your OpenSSL library.


http://www.logix.cz/michal/doc/article.xp/padlock-en#feedback_form
Kano - 08.05.2011, 16:14 Uhr
Titel: VIA C-7 / nano padlock crypto hw support in Hellfire
I have got no VIA hardware, if you like join irc and i tell you how to upgrade to .39 kernel for testing.
mai77 - 08.05.2011, 23:42 Uhr
Titel: VIA C-7 / nano padlock crypto hw s
Idee
mai77 - 09.05.2011, 04:10 Uhr
Titel: VIA C-7 / nano padlock crypto hw support in Hellfire
Idee
Kano - 09.05.2011, 09:59 Uhr
Titel: VIA C-7 / nano padlock crypto hw support in Hellfire
Du kannst den modulnamen einfach in

/etc/modules

schreiben, dann wird es automatisch geladen.
Alle Zeiten sind GMT + 1 Stunde
PNphpBB2 © 2003-2007