Note: If you want to learn about the current situation, you should search the Internet or maybe ask in the forum. This is outdated. Especially if you want to know, how fast a copy from a mounted filesystem (say ext3 over USB) over the scp is, you should specifically search for such benchmarks.
Some models of the BCM47xx/53xx family support hardware accelerated encryption for IPSec (AES, DES, 3DES), simple hash calculations (MD5, SHA1) and TLS/SSL+HMAC processing. Not all devices have a hw crypto supporting chip. At least Asus WL500GD/X, Netgear WGT634U and Asus WL700gE do have hw crypto. However, testing of a WGT634U indicates that a pin under the BCM5365 was not pulled low to enable strong bulk cryptography, limiting the functionality to single DES.
How did you find that out?
Do you get an interrupt when sending a crypto job to the chip and limiting the request to DES only?)
The specification states the hardware is able to support 75Mbps (9,4MB/s) of encrypted throughput. Without hardware acceleration using the blowfish encryption throughput is only ~0,4MB/s.
Benchmark results that show the difference between software and hardware accelerated encryption/decryption can be found here. Due to the overhead of hardware/DMA transfers and buffer copies between kernel/user space it gives only a good return for packet sizes greater than 256 bytes. This size can be reduced for IPSec, because network hardware uses DMA and there is no need to copy the (encrypted) data between kernel and user space.
The hardware specification needed for programming the crypto API of the bcm5365P (Broadcom 5365P) can be found here.
The crypto chip is accessible through the SSB bus (Sonics Silicon Backplane). A Linux driver for SSB is available in OpenWRT's kernel >= 2.6.23 (Kamikaze)
An example about how to communicate with the crypto chip can be found here (file b5365ips.tar.bz2).
An OCF Linux driver that works with the ASUS WL500gP can be found in Trunk (SVN) or here and is called ubsec_ssb. Only OCF-enabled applications can be accelerated. That means, if you want e.g. an accelerated OpenSSH you have to manually enable cryptodev in OpenSSL. The driver is still considered experimental.
Links to mailing-list posts with references to more recent and working version of Linux driver for Broadcom crypto chips here and here.
Sun Crypto Accelerator 500 and 1000 (X6762A) cards are based on BCM5821. Might be worth checking Solaris references as well. Here is OpenSolaris driver for Broadcom crypto chips.
Asus WL-700gE sources come with patched FreeSwan to utilize ubsec.
Closed-source binary included in Asus Wl-700gE sources do support AES based on headers.
There's a Linux port of the OpenBSD Cryptographic Framework (OCF) but the ubsec driver (Broadcom 58xx PCI cards) is not ported yet. If you compile OCF with the /dev/crypto device driver, userspace applications and libraries such as OpenSSL can be accelerated. There are patches for Openswan as well.
Discussion about hardware accelerated crypto.
Various versions of old BCM5820 driver sources.
BCM5801/BCM5805/BCM5820 Security Processor Software Reference Library
http://www.broadcom.com/products/acc...0-SRL101-R.pdf
Cisco PIX VAC+ Encryption module is 64-bit PCI card based on Broadcom BCM5823. Another similar card is Checkpoint VPN-1 Accelerator Card II, III and IV from Silicom.
SoC / CPU Accelerated Methods Datasheet
BCM94704AGR WEP 128, AES OCB AES CCM 94704AGR-PB00-R.pdf
BCM?4704P WEP 128, AES OCB, AES CCM, VPN 94704AGR-PB00-R.pdf
BCM5365 AES (up to 256-bit CTR and CBC modes), DES, 3DES (CBC), HMAC-SHA1, HMAC-MD5, SHA1 and MD5. IPSec encryption and single pass authentication. 5365_5365P-PB01-R.pdf
BCM5365P AES (up to 256-bit CTR and CBC modes), DES, 3DES (CBC), HMAC-SHA1, HMAC-MD5, SHA1 and MD5. IPSec encryption and single pass authentication. 5365_5365P-PB01-R.pdf
Hardware Encryption on WL-500gP / WL-500gD / WL-700gE
Reply With Quote
