Enabling AES instructions
-
I have an AES enabled processor (AMD Kabini A4-5000), but I'm struggling to get the AES crypto instructions working.
I have gone to 'System > Advanced > Misc > Cryptographic Hardware accel' and tried both 'aesni' and 'glxsb' options, but during download tests I still see the same CPU usage % on the dashboard.
(does changine these settings require a reboot?)In 'VPN > OpenVPN > Client > (edit my client)', under 'Hardware Crypto' I have selected 'BSD cryptodev engine', as that seems to be the only option offering AES acceleration.
Before anyone asks - yes I'm using AES encryption, specifically AES-128-CBC.
Is there anything I'm missing or other settings to check to try and get this working? It's not HUGELY important, as I'm getting 100Mbps throughput, using <30% CPU utilisation, but I want to increase to AES-256 soon, so hardware crypto may become more vital.
Many thanks,
Tom. -
OpenVPN will attempt to use AES-NI on its own with nothing selected (and with the module unloaded). Though it does not see the most gain there.
The algorithm that gains the most from AES-NI on pfSense at the moment is AES-GCM, but that is not supported by OpenVPN at this time, only IPsec.
-
Thanks jimp - that would seem to make sense considering the 30% util. of 1.5GHz core at 100Mbps.
Do you have any idea if AES-GCM support is coming to OpenVPN? Is it something that the individual VPN providers would need to make available upon its release, or would it just 'work' once supported by OpenVPN?Many thanks,
Tom. -
It's supposedly going to be in OpenVPN 2.4: https://community.openvpn.net/openvpn/ticket/301
Once they add in support, it should just be a matter of configuring the tunnel to use it.
-
And, additionally, is it enabled in your Bios?
On my server it was NOT enabled by default. ;)There must be a point like "Activate AES NI" or "Use AES NI"…
-
Teddy - Cheers, I will check the Bios! If connected, I'm just going to assume it's working!
Jimp - I have also had confirmation from my VPN provider that support will be added immediately post 2.4 release.
