[Solved] Trying to use openSSL hardware acceleration

Installing and Using OpenWrt
1

Hi, i just installed OpenWrt 19.07.0 RC1 and try to follow this guide (as good as i can understand it): https://openwrt.org/docs/techref/hardware/cryptographic.hardware.accelerators

unfortunately when i try to install "libopenssl-devcrypto" i have a missing dependency:

image
image.png725×436 45.9 KB

does anyone know how to fix this?

EDIT:
After reading the above linked wiki article at least 7 more times i noticed one sentence hidden in the last point of the first list that says that with AES-NI which is a CPU extension no additional kernel drivers are needed (which means it is already used by OpenSSL). Unfortunately that sentence does not really make it clear what that means.
after searching for an hour for more information i found this hint that says if the second command is producing higher numbers than the first then OpenVPN is already using AES-NI:

openssl speed aes-256-cbc
openssl speed -evp aes-256-cbc

which is the case in my case. This means that the speed on my machine is not capped by cryptography but by the slow CPU.

2

Does your CPU have crypto hardware?

3

yes:

root@OpenWrt:~# cat /proc/crypto
name         : xts(aes)
driver       : xts-aes-aesni
module       : kernel
priority     : 401
refcnt       : 1
selftest     : passed
internal     : no
type         : skcipher
async        : yes
blocksize    : 16
min keysize  : 32
max keysize  : 64
ivsize       : 16
chunksize    : 16
walksize     : 16

name         : ctr(aes)
driver       : ctr-aes-aesni
module       : kernel
priority     : 400
refcnt       : 1
selftest     : passed
internal     : no
type         : skcipher
async        : yes
blocksize    : 1
min keysize  : 16
max keysize  : 32
ivsize       : 16
chunksize    : 16
walksize     : 16

name         : cbc(aes)
driver       : cbc-aes-aesni
module       : kernel
priority     : 400
refcnt       : 1
selftest     : passed
internal     : no
type         : skcipher
async        : yes
blocksize    : 16
min keysize  : 16
max keysize  : 32
ivsize       : 16
chunksize    : 16
walksize     : 16

name         : ecb(aes)
driver       : ecb-aes-aesni
module       : kernel
priority     : 400
refcnt       : 1
selftest     : passed
internal     : no
type         : skcipher
async        : yes
blocksize    : 16
min keysize  : 16
max keysize  : 32
ivsize       : 0
chunksize    : 16
walksize     : 16

name         : gcm(aes)
driver       : generic-gcm-aesni
module       : kernel
priority     : 400
refcnt       : 1
selftest     : passed
internal     : no
type         : aead
async        : yes
blocksize    : 1
ivsize       : 12
maxauthsize  : 16
geniv        : <none>

name         : __generic-gcm-aes-aesni
driver       : __driver-generic-gcm-aes-aesni
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
internal     : yes
type         : aead
async        : no
blocksize    : 1
ivsize       : 12
maxauthsize  : 16
geniv        : <none>

name         : rfc4106(gcm(aes))
driver       : rfc4106-gcm-aesni
module       : kernel
priority     : 400
refcnt       : 1
selftest     : passed
internal     : no
type         : aead
async        : yes
blocksize    : 1
ivsize       : 8
maxauthsize  : 16
geniv        : <none>

name         : __gcm-aes-aesni
driver       : __driver-gcm-aes-aesni
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
internal     : yes
type         : aead
async        : no
blocksize    : 1
ivsize       : 8
maxauthsize  : 16
geniv        : <none>

name         : __xts(aes)
driver       : __xts-aes-aesni
module       : kernel
priority     : 401
refcnt       : 1
selftest     : passed
internal     : yes
type         : skcipher
async        : no
blocksize    : 16
min keysize  : 32
max keysize  : 64
ivsize       : 16
chunksize    : 16
walksize     : 16

name         : __ctr(aes)
driver       : __ctr-aes-aesni
module       : kernel
priority     : 400
refcnt       : 1
selftest     : passed
internal     : yes
type         : skcipher
async        : no
blocksize    : 1
min keysize  : 16
max keysize  : 32
ivsize       : 16
chunksize    : 16
walksize     : 16

name         : __cbc(aes)
driver       : __cbc-aes-aesni
module       : kernel
priority     : 400
refcnt       : 1
selftest     : passed
internal     : yes
type         : skcipher
async        : no
blocksize    : 16
min keysize  : 16
max keysize  : 32
ivsize       : 16
chunksize    : 16
walksize     : 16

name         : __ecb(aes)
driver       : __ecb-aes-aesni
module       : kernel
priority     : 400
refcnt       : 1
selftest     : passed
internal     : yes
type         : skcipher
async        : no
blocksize    : 16
min keysize  : 16
max keysize  : 32
ivsize       : 0
chunksize    : 16
walksize     : 16

name         : __aes
driver       : __aes-aesni
module       : kernel
priority     : 300
refcnt       : 1
selftest     : passed
internal     : yes
type         : cipher
blocksize    : 16
min keysize  : 16
max keysize  : 32

name         : aes
driver       : aes-aesni
module       : kernel
priority     : 300
refcnt       : 2
selftest     : passed
internal     : no
type         : cipher
blocksize    : 16
min keysize  : 16
max keysize  : 32

name         : crct10dif
driver       : crct10dif-generic
module       : kernel
priority     : 100
refcnt       : 2
selftest     : passed
internal     : no
type         : shash
blocksize    : 1
digestsize   : 2

name         : crc32
driver       : crc32-generic
module       : kernel
priority     : 100
refcnt       : 2
selftest     : passed
internal     : no
type         : shash
blocksize    : 1
digestsize   : 4

name         : crc32c
driver       : crc32c-generic
module       : kernel
priority     : 100
refcnt       : 2
selftest     : passed
internal     : no
type         : shash
blocksize    : 1
digestsize   : 4

name         : ecb(arc4)
driver       : ecb(arc4)-generic
module       : kernel
priority     : 100
refcnt       : 1
selftest     : passed
internal     : no
type         : blkcipher
blocksize    : 1
min keysize  : 1
max keysize  : 256
ivsize       : 0
geniv        : <default>

name         : arc4
driver       : arc4-generic
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
internal     : no
type         : cipher
blocksize    : 1
min keysize  : 1
max keysize  : 256

name         : aes
driver       : aes-generic
module       : kernel
priority     : 100
refcnt       : 1
selftest     : passed
internal     : no
type         : cipher
blocksize    : 16
min keysize  : 16
max keysize  : 32

name         : digest_null
driver       : digest_null-generic
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
internal     : no
type         : shash
blocksize    : 1
digestsize   : 0

name         : compress_null
driver       : compress_null-generic
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
internal     : no
type         : compression

name         : ecb(cipher_null)
driver       : ecb-cipher_null
module       : kernel
priority     : 100
refcnt       : 1
selftest     : passed
internal     : no
type         : blkcipher
blocksize    : 1
min keysize  : 0
max keysize  : 0
ivsize       : 0
geniv        : <default>

name         : cipher_null
driver       : cipher_null-generic
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
internal     : no
type         : cipher
blocksize    : 1
min keysize  : 0
max keysize  : 0

name         : aes
driver       : aes-asm
module       : kernel
priority     : 200
refcnt       : 1
selftest     : passed
internal     : no
type         : cipher
blocksize    : 16
min keysize  : 16
max keysize  : 32
4

Could be mistaken, but I did not think the bot builds enabled this; ergo the red letter warning in the message box. I think you need to build it to have it. But check the repo for existence.

5

and how do i build it?

6

How to build is on the OpenWrt wiki. But given that you appear to want AES-NI (integral to CPU), and since relevant assembler bits (intense computations) are hand-crafted in openssl, this seems unnecessary.

openssl dump

printf '******** Test openssl \n' > /tmp/junk
date >> /tmp/junk
printf '\n************************\n' >> /tmp/junk
cat /etc/openwrt_release >> /tmp/junk
uname -a >> /tmp/junk
printf '\n*********************************\n' >> /tmp/junk
openssl engine -t -c -vv >> /tmp/junk
printf '\n*********************************\n' >> /tmp/junk
openssl engine -pre DUMP_INFO afalg >> /tmp/junk 2>&1
openssl engine -pre DUMP_INFO devcrypto >> /tmp/junk 2>&1
printf '\n*********************************\n' >> /tmp/junk
printf '\nRunning --> time -v openssl speed -elapsed -evp AES-128-CBC -engine afalg <--\n\n' >> /tmp/junk
time -v openssl speed -elapsed -evp AES-128-CBC -engine afalg >> /tmp/junk 2>&1
printf '\n*********************************\n' >> /tmp/junk
printf '\nRunning --> time -v openssl speed -elapsed -evp AES-128-CBC -engine devcrypto <--\n\n' >> /tmp/junk
time -v openssl speed -elapsed -evp AES-128-CBC -engine devcrypto >> /tmp/junk 2>&1
printf '\n*********************************\n' >> /tmp/junk
printf '\nRunning --> time -v openssl speed -elapsed -evp AES-256-ECB -engine afalg <--\n\n' >> /tmp/junk
time -v openssl speed -elapsed -evp AES-256-ECB -engine afalg >> /tmp/junk 2>&1
printf '\n*********************************\n' >> /tmp/junk
printf '\nRunning --> time -v openssl speed -elapsed -evp AES-256-ECB -engine devcrypto <--\n\n' >> /tmp/junk
time -v openssl speed -elapsed -evp AES-256-ECB -engine devcrypto >> /tmp/junk 2>&1
printf '\n*********************************\n' >> /tmp/junk
printf '\nRunning --> time -v openssl -elapsed speed -evp SHA256 -engine afalg <--\n\n' >> /tmp/junk
time -v openssl speed -elapsed -evp SHA256 -engine afalg >> /tmp/junk 2>&1
printf '\n*********************************\n' >> /tmp/junk
printf '\nRunning --> time -v openssl speed -elapsed -evp SHA256 -engine devcrypto <--\n\n' >> /tmp/junk
time -v openssl speed -elapsed -evp SHA256 -engine devcrypto >> /tmp/junk 2>&1
#printf '\n*********************************\n' >> /tmp/junk
#printf '\nRunning --> time -v openssl speed -elapsed -evp MD5 <--\n\n' >> /tmp/junk
#time -v openssl speed -elapsed -evp MD5 >> /tmp/junk 2>&1
printf '\n*********************************\n' >> /tmp/junk