hardware crypto and SSL?

[Sam Leffler]

On Wednesday 22 October 2003 07:35 am, Mike Tancsa wrote:
> At 11:44 PM 21/10/2003, Mike Tancsa wrote:
> >Dont know about http ssl, but I am using the cards from Soekris for my
> >backup server.  As long as you use 3des for encryption, it does make a big
> >difference CPU wise.   The next generation cards supposedly have AES and
> >public key generation, but I dont think the driver will do the public key
> >stuff. The safe driver says it does, but I dont know where to get such
> > cards.
>
> Sorry, I was misspeaking about the safe driver.  At the bottom, the Bugs
> section says, "Public key support is not implemented."
>

Actually, Jason Wright took the driver and added PK support but I haven't 
brought the changes back to FreeBSD yet.  One big problem with the safenet 
chips for PK is that they require polling to get the results!  Needless to 
say this is not optimal.

> I would say give the Soekris card a try. Its $80 and it will help with the
> SHA1 and MD5 calcs as well as provide good RNG. It wont help with RSA key
> generation unfortunately where much of the initial overhead comes from.

The hifn 7955-based cards from Soekris should be available soon.  I have no 
more info than you do other than I've worked with a prototype that was real.  
There are still some issues to work out in the driver but between Jason and I 
it should be well supported in time.  The big win is that it's got AES and PK 
support and should be inexpensive.  A Safenet-based card that does all this 
too should be available sometime also but I'm not sure what the product plans 
are for that (and no I can't say who's doing the card).

	Sam