23.09.01 Hardware Crypto showing No Hardware Crypto Acceleration for system with crypto chip installed

JonathanLee

@SteveITS should it still list it? Under 23.05.01 it would show the chip to select and use. Now it’s not listed

SteveITS

@JonathanLee I'm not clear what "it" is in your question?

a 2100 on 23.05.1:
Hardware crypto AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256,SHA384,SHA512

a 2100 on 23.09.1:
Hardware crypto AES-CBC, AES-CCM, AES-GCM, AES-ICM, AES-XTS, ChaCha20-Poly1305, SHA1, SHA256, SHA384, SHA512

If you're talking about the Hardware Crypto dropdown in the OpenVPN settings I think it basically ignores that anyway?

https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/configure-server-crypto.html#hardware-crypto
"If available, this option controls which hardware cryptographic accelerator will be used by OpenVPN. When left unspecified, OpenVPN will choose automatically based on what is available in the operating system to accelerate ciphers OpenVPN wants to use.

Some hardware acceleration, such as AES-NI, happens automatically in OpenVPN via OpenSSL and cannot be enabled or disabled by this option.

Note
In most common deployments this setting is unnecessary as the automatic behavior of OpenVPN is correct."

JonathanLee

@SteveITS cool cool, maybe I was expecting fireworks or blinking leds or something, so I changed the firewall leds to be purple when the VPN state establishes, it helps me know when to not mess with it.

Thanks for the reply

JonathanLee

@SteveITS the device id shows error in 23.09.01 and it didn’t in 23.05.01

JonathanLee

In 23.09.01

JonathanLee

It shows nothing for me, with

DOC enabled or disabled
encryption with removed chacha and enabled chacha
IPsec-MB enabled or disabled

23.09.01 I can't get it to run

JonathanLee

In 23.05.01:

Chip working

Chip listed

Listed the chip

increments on use now shows 80

My device was purchased direct from Netgate and contains the chip.

What should I do???

stephenw10

OpenSSL no longer supports the BSD cryptodev device as an 'engine'. Selecting it there does nothing so it was removed.

SafeXcel should still be used for kernel mode crypto though so if you have DCO enabled.

Steve

JonathanLee

@stephenw10 I do have it enabled, though VM stat still shows no increments Or any status for the Chip what can be done to correct that? Thanks for the reply. Have a good day.

Just for clarification the new 2100s ship without a cypher chip? My version was the more expensive 2100MAX it came with a SSD and the cypher chip. Is it possible the updates repos do not know difference between the older 2100? and the new 2100s?

Like a hypothetical model 2100A and 2100B ????

If so how can I get my chip to work the speed is drastically different on VPN use with it enabled.

stephenw10

Try disabling iimb. That will try to register against many of the same ciphers.

JonathanLee

@stephenw10 I did that same results dang. Please let me know if you find a advanced option for customers like me.

stephenw10

Do you actually see a reduction in throughput though? Or an increase in CPU usage?

JonathanLee

@stephenw10 yes with use on 22.05.01.

stephenw10

Like throughput is lower in 23.09.1 compared to 23.05.1?

JonathanLee

@stephenw10 let me test again hold on I turned 23.09.01 on again.

Nope it’s 130kbs with dsl on 23.09.01
It’s 123kb in 23.05.01

Just checked with my pdfs again.

stephenw10

Hmm, those seem very low numbers. I can't imagine you'd be able to see the difference at those rates.

JonathanLee

@stephenw10 low bill too :) that ID error is why I think it has issues would ath0 cause this ?

stephenw10

No this is nothing to do with the ath card or newer 2100s without the crypto cert device. OpenSSL no longer supports BSD cryptodev as an engine so the option to select it was removed from OpenVPN for all hardware.

Which ID error are you referring to?

JonathanLee

@stephenw10

The id error shows on 23.09.01 every time does not show in 23.05.01

stephenw10

Ah OK. That seems unlikely to be related to the crypto hardware. If you disable safeXcel but keep DCO enabled does it still show?