From owner-freebsd-stable Fri Jan 24 10:26:59 2003 Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2D0CA37B401 for ; Fri, 24 Jan 2003 10:26:58 -0800 (PST) Received: from ebb.errno.com (ebb.errno.com [66.127.85.87]) by mx1.FreeBSD.org (Postfix) with ESMTP id 74A4A43F1E for ; Fri, 24 Jan 2003 10:26:57 -0800 (PST) (envelope-from sam@errno.com) Received: from melange (melange.errno.com [66.127.85.82]) (authenticated bits=0) by ebb.errno.com (8.12.5/8.12.1) with ESMTP id h0OIQunN090735 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Fri, 24 Jan 2003 10:26:57 -0800 (PST)?g (envelope-from sam@errno.com)œ X-Authentication-Warning: ebb.errno.com: Host melange.errno.com [66.127.85.82] claimed to be melange Message-ID: <192f01c2c3d6$2d5666d0$52557f42@errno.com> From: "Sam Leffler" To: "Mike Tancsa" Cc: References: <5.2.0.9.0.20030124073321.07012c88@192.168.0.12> <5.2.0.9.0.20030124122133.06c66610@marble.sentex.ca> Subject: Re: HEADS UP: fast ipsec committed Date: Fri, 24 Jan 2003 10:26:56 -0800 Organization: Errno Consulting MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4807.1700 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700 Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG > At 09:11 AM 24/01/2003 -0800, Sam Leffler wrote: > > > At 09:39 PM 1/23/2003 -0800, Sam Leffler wrote: > > > >I just commited my "Fast IPsec" support. This is an implementation of > >the > > > >IPsec protocols that makes use of the kernel crypto framework. What this > > > >means is that if you have a hardware crypto card it will automatically be > > > >used by the protocols. If you don't have crypto hardware you will use > >the > > > >host cpu as before. > > > > > > Hi, > > > Apart from FAST_IPSEC and OpenSSL 0.9.7, what parts (if any) of > > > FreeBSD would currently make sure of the crypto hardware ? > > > >With OpenSSL you get lots of applications. I'm not sure if Kerberos also > >benefits. In the kernel there's nothing else at the moment but that's not > >to say that things like gbde couldn't use it. I also intend to use it to do > >AES for wireless security protocols. > > > Thanks for the info! Just to confirm/clarify, without FAST_IPSEC enabled, > none of the crypto hardware is used in IPSEC, correct ? Correct. Also, you can control the use of h/w crypto with the net.inet.ipsec.crypto_support sysctl: set it -1 to get s/w only, 1 for h/w only, or 0 (default) to take the best available crypto support. Sam To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message