New Tunable: kern.crypto.iimb.enable_aescbc on fresh install

[luckman212]

Noticed a new tunable that I haven't seen before

kern.crypto.iimb.enable_aescbc

On a stock 6100 25.07 RC install, this is being set to 0

Any more info on this?

[provels]

@luckman212
Docs
Maybe because QAT is faster? It's '1' on mine, but my proc doesn't have QAT.

[tedquade]

@luckman212 On my stock 6100MAX 25.07RC it is set to 1.

Ted

[luckman212]

@tedquade Guess when 25.07 officially releases I'll factory erase and check again.

[mcury]

SG-4100, 24.11, set to 0 here.
Weird, this is explicit set in my config file:

<sysctl>
<item>
<tunable>kern.crypto.iimb.enable_aescbc</tunable>
<value>0</value>
</item>
</sysctl>

Edit:
If you enable IPsec-MB, it will set kern.crypto.iimb.enable_aescbc to 0.
Since I`m running Wireguard only, that is what I want, in my SG-4100.
Just a FYI only, QAT is enabled but not in use.

[dennypage]

@luckman212 said in New Tunable: kern.crypto.iimb.enable_aescbc on fresh install:

Noticed a new tunable that I haven't seen before

kern.crypto.iimb.enable_aescbc
On a stock 6100 25.07 RC install, this is being set to 0

Any more info on this?

See documentation on Crypto here.

[luckman212]

@dennypage Yes thanks I saw that, so I assume that for the 6100 (which does have QAT) that 0 is the preferred value here? Or does it not even really matter much?

[provels]

@luckman212 No idea, just spitballing, but is it dependent on the type of VPN you choose? I use OpenVPN, not IPSec.