On 15/02/2011 20:26, Sterling James wrote:
I starting to get a little confused, since I thought this provided openssh
the use of OpenSSL dynamic engine loading support, so that the ibmca
engine can now use Central Processor Assist for Cryptographic Function
(CPACF). If that were true, use of CPACF would not be reflected in
/proc/driver/z90crypt.
I may be bery confused.
It is confusing. CPACF covers symmetric ciphers (DES, AES), hashing
(MD5, SHA), and random number generation. It requires openssl / openssh
engine support and the right ibmca packages, but no special hardware.
You can check the op count using "icastats" (in recent tools).
CEX cards cover asymmetric / public key crypto (RSA). (They can also
generate and store secure private keys, but that's outside the scope of
this thread.) It requires openssl / openssh engine support and the
z90crypt driver. You can check the op count in /proc/driver/z90crypt.
Other apps apart from SSH can benefit from these subsystems. Good
candidates which spring to mind are https webservers and other apps
which make use of SSL for network traffic. Don't forget to configure the
appropriate preference list in the software to target the
hardware-accelerated ciphersuites.
Cheers,
Phil
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For more information on Linux on System z, visit
http://wiki.linuxvm.org/
