[openssl-users] How to let OpenSSL applications/utilities use SunSPARC crypto accelerators?

[Aaron]

Hello OpenSSL folks,

I noticed that the OpenSSL command line utility 'openssl' built in Solaris
11.1 does not use SunSPARC crypto accelerators. 

>From the change log of OpenSSL 1.0.2, I saw the following description.
Changes between 1.0.1l and 1.0.2 [22 Jan 2015] 
... 
  *) Support for SPARC Architecture 2011 crypto extensions, first 
     implemented in SPARC T4. This covers AES, DES, Camellia, SHA1, 
     SHA256/512, MD5, GHASH and modular exponentiation. 
     [Andy Polyakov, David Miller] 
...

My understanding is that starting from OpenSSL 1.0.2, OpenSSL
applications/utilities would use SunSPARC crypto accelerator in Solaris 11.1
which has the accelerator. 

However my tests show there is no difference between the performance of
'openssl' 1.0.1p and that of its 1.0.2d counterpart. 

 ksol1% ./1.0.1p/shared64bit/openssl/bin/openssl speed -evp aes-128-cbc 
WARNING: can't open config file: /usr/local/ssl/openssl.cnf 
Doing aes-128-cbc for 3s on 16 size blocks: 19705194 aes-128-cbc's in 3.00s 
Doing aes-128-cbc for 3s on 64 size blocks: 5257594 aes-128-cbc's in 3.00s 
Doing aes-128-cbc for 3s on 256 size blocks: 1361128 aes-128-cbc's in 3.00s 
Doing aes-128-cbc for 3s on 1024 size blocks: 343333 aes-128-cbc's in 3.00s 
Doing aes-128-cbc for 3s on 8192 size blocks: 43029 aes-128-cbc's in 3.00s 
OpenSSL 1.0.1p-fips 9 Jul 2015 
built on: Thu Jul  9 23:22:11 2015 
options:bn(64,32) rc4(ptr,char) des(ptr,risc1,16,int) aes(partial)
blowfish(ptr) 

compiler: cc -I. -I.. -I../include  -DOPENSSL_THREADS -D_REENTRANT
-DDSO_DLFCN - 
DHAVE_DLFCN_H -DOPENSSL_BUILD -KPIC -xtarget=ultra -xarch=v9 -xO5 -xstrconst
-xd 
epend -Xa -DB_ENDIAN -DOPENSSL_BN_ASM_MONT
-I/leo_ocsdev/qun/csi/allbuilt/main10 
/built/ant-generated/fips-sun_svr4/include -DSHA1_ASM -DSHA256_ASM
-DSHA512_ASM 
-DAES_ASM -DGHASH_ASM 
The 'numbers' are in 1000s of bytes per second processed. 
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192
bytes 
aes-128-cbc     105094.37k   112162.01k   116149.59k   117191.00k  
117497.86k 

ksol1% ./1.0.2d/shared64bit/openssl/bin/openssl speed -evp aes-128-cbc 
WARNING: can't open config file: /usr/local/ssl/openssl.cnf 
Doing aes-128-cbc for 3s on 16 size blocks: 18777502 aes-128-cbc's in 3.00s 
Doing aes-128-cbc for 3s on 64 size blocks: 5066291 aes-128-cbc's in 3.00s 
Doing aes-128-cbc for 3s on 256 size blocks: 1317102 aes-128-cbc's in 3.00s 
Doing aes-128-cbc for 3s on 1024 size blocks: 331672 aes-128-cbc's in 3.00s 
Doing aes-128-cbc for 3s on 8192 size blocks: 40739 aes-128-cbc's in 3.00s 
OpenSSL 1.0.2d-fips 9 Jul 2015 
built on: reproducible build, date unspecified 
options:bn(64,32) rc4(ptr,char) des(ptr,risc1,16,int) aes(partial)
blowfish(ptr) 

compiler: cc -I. -I.. -I../include  -DOPENSSL_THREADS -D_REENTRANT
-DDSO_DLFCN - 
DHAVE_DLFCN_H -DOPENSSL_BUILD -KPIC -xtarget=ultra -xarch=v9 -xO5 -xstrconst
-xd 
epend -Xa -DB_ENDIAN
-I/leo_ocsdev/qun/csi/allbuilt/main12/built/ant-generated/f 
ips-sun_svr4/include 
The 'numbers' are in 1000s of bytes per second processed. 
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192
bytes 
aes-128-cbc     100146.68k   108080.87k   112392.70k   113210.71k  
111244.63k 

I built 'openssl' on Solaris 11.1 using the following commands. 
Configure no-idea no-mdc2 no-rc5 no-asm solaris64-sparcv9-cc -KPIC 
make clean 
make 
make test 
make install 

When testing the default openssl installed in /usr/bin/ on Solaris 11.1, I
saw a much better result below. 
ksol1% /usr/bin/openssl speed -evp aes-128-cbc 
Doing aes-128-cbc for 3s on 16 size blocks: 113798920 aes-128-cbc's in 2.99s 
Doing aes-128-cbc for 3s on 64 size blocks: 48425338 aes-128-cbc's in 3.00s 
Doing aes-128-cbc for 3s on 256 size blocks: 14613535 aes-128-cbc's in 3.00s 
Doing aes-128-cbc for 3s on 1024 size blocks: 3768123 aes-128-cbc's in 3.00s 
Doing aes-128-cbc for 3s on 8192 size blocks: 488001 aes-128-cbc's in 3.00s 
OpenSSL 1.0.0k 5 Feb 2013 
built on: date not available 
options:bn(64,32) md2(int) rc4(ptr,int) des(ptr,risc1,16,int) aes(partial)
blowf 
ish(ptr) 
compiler: information not available 
The 'numbers' are in 1000s of bytes per second processed. 
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192
bytes 
aes-128-cbc     608957.43k  1033073.88k  1247021.65k  1286185.98k 
1332568.06k 

Hence I believe OpenSSL utility 'openssl' built by me does not use the
hardware crypto accelerators at all. 

I wonder if anyone knows the reason. 

Thanks in advance,
Aaron




--
View this message in context: http://openssl.6102.n7.nabble.com/How-to-let-OpenSSL-applications-utilities-use-SunSPARC-crypto-accelerators-tp59163.html
Sent from the OpenSSL - User mailing list archive at Nabble.com.