[dm-crypt] Using AES-256 Controller Card

[dm-crypt] Using AES-256 Controller Card

[Michael Wisniewski]

Hi!

I'm interested in using dm-crypt to do full-drive encryption, but do
not want my processor to be stuck doing the encryption.
Unfortunately, it does not support the aes-ni extension.  As an
alternative to upgrading, I was wondering if dm-crypt supports a sata
controller card that "supports aes-256".  An example can be found
here...

Koutech PESI330

http://www.koutech.com/proddetail.asp?linenumber=492

Would I be able to offload the encryption to the add-in card's chip?

Thanks!

[dm-crypt] Using AES-256 Controller Card

[Michael Wisniewski]

Hi!

I'm interested in using dm-crypt to do full-drive encryption, but do
not want my processor to be stuck doing the encryption.
Unfortunately, it does not support the aes-ni extension.  As an
alternative to upgrading, I was wondering if dm-crypt supports a sata
controller card that "supports aes-256".  An example can be found
here...

Koutech PESI330

http://www.koutech.com/proddetail.asp?linenumber=492

Would I be able to offload the encryption to the add-in card's chip?

Thanks!

Re: [dm-crypt] Using AES-256 Controller Card

[Milan Broz]

On 08/27/2012 03:42 PM, Michael Wisniewski wrote:
> I'm interested in using dm-crypt to do full-drive encryption, but do
> not want my processor to be stuck doing the encryption.
> Unfortunately, it does not support the aes-ni extension.  As an
> alternative to upgrading, I was wondering if dm-crypt supports a sata
> controller card that "supports aes-256".  An example can be found
> here...
> 
> Koutech PESI330

No, dmcrypt cannot use this.

It is (SATA) Chipset FDE (full disk encryption), IOW few layers below
dmcrypt operates.

Milan

Re: [dm-crypt] Using AES-256 Controller Card

[Michael Wisniewski]

Thank you for the information.  You just saved me 30 some bucks!


On Mon, Aug 27, 2012 at 10:23 AM, Milan Broz <mbroz@redhat.com> wrote:
> On 08/27/2012 03:42 PM, Michael Wisniewski wrote:
>> I'm interested in using dm-crypt to do full-drive encryption, but do
>> not want my processor to be stuck doing the encryption.
>> Unfortunately, it does not support the aes-ni extension.  As an
>> alternative to upgrading, I was wondering if dm-crypt supports a sata
>> controller card that "supports aes-256".  An example can be found
>> here...
>>
>> Koutech PESI330
>
> No, dmcrypt cannot use this.
>
> It is (SATA) Chipset FDE (full disk encryption), IOW few layers below
> dmcrypt operates.
>
> Milan

Re: [dm-crypt] Using AES-256 Controller Card

[Brian J. Murrell]

[-- Attachment #1: Type: text/plain, Size: 237 bytes --]

On 12-08-27 11:23 AM, Milan Broz wrote:
> 
> It is (SATA) Chipset FDE (full disk encryption), IOW few layers below
> dmcrypt operates.

Is there any add-on (i.e. USB perhaps) hardware that can assist dm-crypt?

Cheers,
b.




[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]

Re: [dm-crypt] Using AES-256 Controller Card

[Matthias Schniedermeyer]

On 27.08.2012 11:33, Brian J. Murrell wrote:
> On 12-08-27 11:23 AM, Milan Broz wrote:
> > 
> > It is (SATA) Chipset FDE (full disk encryption), IOW few layers below
> > dmcrypt operates.
> 
> Is there any add-on (i.e. USB perhaps) hardware that can assist dm-crypt?

Contrary to OP: AES-NI

I did the test that is descripted on this page:
http://wiki.debianforum.de/Benchmark_f%C3%BCr_Festplattenverschl%C3%BCsselung
(Extended to 10GiB instead of the described 512MiB)

My computer (Core i7 3770): does:
10735321088 bytes (11 GB) copied, 9.62266 s, 1.1 GB/s
10735321088 bytes (11 GB) copied, 9.71015 s, 1.1 GB/s
10735321088 bytes (11 GB) copied, 9.67001 s, 1.1 GB/s
10735321088 bytes (11 GB) copied, 9.61184 s, 1.1 GB/s
10735321088 bytes (11 GB) copied, 9.79301 s, 1.1 GB/s
10735321088 bytes (11 GB) copied, 9.96204 s, 1.1 GB/s
10735321088 bytes (11 GB) copied, 9.59942 s, 1.1 GB/s
10735321088 bytes (11 GB) copied, 9.61019 s, 1.1 GB/s
10735321088 bytes (11 GB) copied, 9.72707 s, 1.1 GB/s
10735321088 bytes (11 GB) copied, 9.88943 s, 1.1 GB/s

So it's between 1066.52 MiB/s and 1027.7 MiB/s

While the test is running, one core is @100%, the other 3 @50%
(The 4 HT-Cores aren't used) so there is a bottleneck somewhere and 
this isn't the theoretical maximum.





Bis denn

-- 
Real Programmers consider "what you see is what you get" to be just as 
bad a concept in Text Editors as it is in women. No, the Real Programmer
wants a "you asked for it, you got it" text editor -- complicated, 
cryptic, powerful, unforgiving, dangerous.

Re: [dm-crypt] Using AES-256 Controller Card

[Michael Wisniewski]

On Mon, Aug 27, 2012 at 1:16 PM, Matthias Schniedermeyer <ms@citd.de> wrote:
> On 27.08.2012 11:33, Brian J. Murrell wrote:
>> On 12-08-27 11:23 AM, Milan Broz wrote:
>> >
>> > It is (SATA) Chipset FDE (full disk encryption), IOW few layers below
>> > dmcrypt operates.
>>
>> Is there any add-on (i.e. USB perhaps) hardware that can assist dm-crypt?
>
> Contrary to OP: AES-NI
>
> I did the test that is descripted on this page:
> http://wiki.debianforum.de/Benchmark_f%C3%BCr_Festplattenverschl%C3%BCsselung
> (Extended to 10GiB instead of the described 512MiB)
>

Thanks for this link.  I was able to match up a similar processor to
mine and find it's 98 MB/s.  It gives me a good idea of what to
expect.

I'm not sure of any addon cards, but it would be great if it was
supported.  I know IPSec can utilize the Hifn addon card for
encryption and takes a lot of the load off the processor.  I'd hate to
blow a couple of hundred on a new motherboard, processor, and memory
if I can spent 50 bucks on an add-in card.

Thanks!

Re: [dm-crypt] Using AES-256 Controller Card

[Brian J. Murrell]

[-- Attachment #1: Type: text/plain, Size: 298 bytes --]

On 12-08-27 02:16 PM, Matthias Schniedermeyer wrote:
> 
> Contrary to OP: AES-NI

OP doesn't have AES-NI so it's performance gains are orthogonal.

> So it's between 1066.52 MiB/s and 1027.7 MiB/s

Sure, but OP doesn't have AES-NI on his CPU, so I'm not sure the point.

Cheers,
b.



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]

Re: [dm-crypt] Using AES-256 Controller Card

[Matthias Schniedermeyer]

On 27.08.2012 14:35, Brian J. Murrell wrote:
> On 12-08-27 02:16 PM, Matthias Schniedermeyer wrote:
> > 
> > Contrary to OP: AES-NI
> 
> OP doesn't have AES-NI so it's performance gains are orthogonal.
> 
> > So it's between 1066.52 MiB/s and 1027.7 MiB/s
> 
> Sure, but OP doesn't have AES-NI on his CPU, so I'm not sure the point.

Hmm. I reread the original post and i have to say: It's ambiguous.

What i read, and what stuck in my head, was "dmcrypt doesn't support 
AES-NI", not "my CPU doesn't support AES-NI".

But i guess the OP meant the latter, so my mistake.




Bis denn

-- 
Real Programmers consider "what you see is what you get" to be just as 
bad a concept in Text Editors as it is in women. No, the Real Programmer
wants a "you asked for it, you got it" text editor -- complicated, 
cryptic, powerful, unforgiving, dangerous.