Re: OpenSSL + opencrypto

[Jason Thorpe <thorpej%wasabisystems.com@localhost>]

On Wednesday, August 27, 2003, at 05:07  PM, Jonathan Stone wrote:

> NB: the kernel currently honours requests on /dev/crypto transforms
> which end up being handled in software. That's a
> performance-measurement hack: both FreeBSD and OpenBSD disallow
> /dev/crypto access to software operations.  I'd planned to turn them
> off just before the openssl libcrypto patches go in.

Seems like that should be a per-file descriptor policy tweak.  I'd say 
default to "don't allow software transforms to service this fd", but 
add an ioctl to enable it.  My measurements clearly show that the 
in-kernel 3des-cbc is faster than the libcrypto one for large blocks!

(Though, "non-preemptable kernel time" vs. "preemptable user time" is 
one aspect of the issue to consider, I guess :-)

        -- Jason R. Thorpe <thorpej%wasabisystems.com@localhost>