Re: OpenSSL + opencrypto
Jason Thorpe <[email protected]>
| Newsgroups | gmane.os.netbsd.devel.crypto |
|---|---|
| Message-ID | <[email protected]> |
On Wednesday, August 27, 2003, at 05:07 PM, Jonathan Stone wrote:
> NB: the kernel currently honours requests on /dev/crypto transforms
> which end up being handled in software. That's a
> performance-measurement hack: both FreeBSD and OpenBSD disallow
> /dev/crypto access to software operations. I'd planned to turn them
> off just before the openssl libcrypto patches go in.
Seems like that should be a per-file descriptor policy tweak. I'd say
default to "don't allow software transforms to service this fd", but
add an ioctl to enable it. My measurements clearly show that the
in-kernel 3des-cbc is faster than the libcrypto one for large blocks!
(Though, "non-preemptable kernel time" vs. "preemptable user time" is
one aspect of the issue to consider, I guess :-)
-- Jason R. Thorpe <[email protected]>