Hello, just to put together some informations when we talk about 'Clear Key' Crypto support. In general following is necessary to know about the different crypto possibilities:
1) For Clear Key normally libica is used to process crypto requests coming
from:
- applications directly using libica API's
- opencryptoki which supports PKCS#11 API's used
by applications
- openssl engine ibmca connected to openssl via
settings in the openssl.cnf (shown in some notes before)
So applications have different ways to use HW crypto support. In
some applications such HW support needs to be compiled in or special
settings in the configuration files.
There are also other applications like IPSEC which can use another
way to get clear key crypto requests done. They use InKernel crypto
modules. There are s390 modules
available in the kernel which uses CPACF. You can see infos only
about loaded modules via /proc/crypto.
2) If a request comes to libica then following questions will be asked in
the given sequence:
1. Can the request done by CPACF ?
If yes then CPACF is used for the request. The scope
of available CPACF functions depends on the available System z and if
CPACF is enabled on those systems.
Only symmetric ciphers and hashing is available. For
a z10 it is AES, DES, 3DES, SHA, Random (Remark: We do not support MD5
via CPACF)
If no then go to 2.
2. Can this request done by a Crypto Card (Accelerator or
Coprocessor Type)?
If yes then libica gets in contact with the card via
device driver z90crypt and sent the request. Be aware that only RSA
request (asymmetric cipher) will be handled by a card for Clear Key
Cryptography. Where a accelerator is much more faster
than a coprocessor card.
If no go to 3.
3. All requests coming to this points are handled then by
the software fall back solution of libica.
You only can use /proc/driver/z90crypt to see the requests going to the
crypto cards.
If available icastats gives you more information. On the HW column you can
see if CPACF or crypto cards ('mod expo' or 'rsa crt' both are RSA modes)
are used.
On the SW column you see if SW fall back was used. If icastats is not
available (like on SLES10 SP3) then there is no way to see directly if
CPACF is used, only indirect you can see this via CPU usage
difference between a SW solution or HW solution.
Hope this mail can give some clarification on this crypto topic.
Mit freundlichen Grüßen / Kind regards
Arthur Winterling
SW Test Specialist, Linux Test Automation
IBM Systems &Technology Group, Systems Software Development
SW Linux on System z System&Performance Evaluation
Phone:
+49-7031-16-3574
IBM Deutschland Research & Development GmbH
E-Mail:
[email protected]
Schoenaicher Str. 220
71032 Boeblingen
Germany
IBM Deutschland Research & Development GmbH / Vorsitzender des
Aufsichtsrats: Martin Jetter
Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart,
HRB 243294
From:
Philip Rowlands <[email protected]>
To:
[email protected]
Date:
15.02.2011 21:34
Subject:
Re: crypto with sshd
Sent by:
Linux on 390 Port <[email protected]>
On 15/02/2011 20:26, Sterling James wrote:
> I starting to get a little confused, since I thought this provided
openssh
> the use of OpenSSL dynamic engine loading support, so that the ibmca
> engine can now use Central Processor Assist for Cryptographic Function
> (CPACF). If that were true, use of CPACF would not be reflected in
> /proc/driver/z90crypt.
>
> I may be bery confused.
It is confusing. CPACF covers symmetric ciphers (DES, AES), hashing
(MD5, SHA), and random number generation. It requires openssl / openssh
engine support and the right ibmca packages, but no special hardware.
You can check the op count using "icastats" (in recent tools).
CEX cards cover asymmetric / public key crypto (RSA). (They can also
generate and store secure private keys, but that's outside the scope of
this thread.) It requires openssl / openssh engine support and the
z90crypt driver. You can check the op count in /proc/driver/z90crypt.
Other apps apart from SSH can benefit from these subsystems. Good
candidates which spring to mind are https webservers and other apps
which make use of SSL for network traffic. Don't forget to configure the
appropriate preference list in the software to target the
hardware-accelerated ciphersuites.
Cheers,
Phil
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO LINUX-390 or
visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For more information on Linux on System z, visit
http://wiki.linuxvm.org/
<<image/gif>>
