Release 9.2 VIA padlock not working, block cipher change needed

[wipeout40k]

Hi there,

I installed freenas 9.2 yesterday becaue of the implementation of VIA padlock hardware acceleration. Well maybe one of you guys can help me, i´ve got a little problem with the freenas release 9.2, i have a via cpu with padlock, but the hardware acceleration only works with aes-cbc block cipher, geom_eli uses aes-xts for encrypted drives so crypto runs in software mode, anyway to change the default configuration to aes-cbc?

Here is output from dmesg|grep adlock
VIA Padlock Features=0x70dcc<RNG,AES,AES-CTR,SHA1,SHA256>
padlock0: <AES-CBC,SHA1,SHA256> on motherboard

I also created 2 test devices:
geli onetime -s 4096 -l 256 -e aes-cbc gzero
geli onetime -s 4096 -l 256 -e aes-xts gzero


Here the output from geli list:

[root@freenas] ~# geli list -a
Geom name: gzero.eli
State: ACTIVE
EncryptionAlgorithm: AES-CBC
KeyLength: 256
Crypto: hardware
Flags: ONETIME
KeysAllocated: 2
KeysTotal: 268435456
Providers:
1. Name: gzero.eli
Mediasize: 1152921504606846976 (1.0E)
Sectorsize: 4096
Mode: r0w0e0
Consumers:
1. Name: gzero
Mediasize: 1152921504606846976 (1.0E)
Sectorsize: 512
Mode: r1w1e1

Geom name: gzero.eli
State: ACTIVE
EncryptionAlgorithm: AES-XTS
KeyLength: 256
Crypto: software
Flags: ONETIME
KeysAllocated: 2
KeysTotal: 268435456
Providers:
1. Name: gzero.eli
Mediasize: 1152921504606846976 (1.0E)
Sectorsize: 4096
Mode: r0w0e0
Consumers:
1. Name: gzero
Mediasize: 1152921504606846976 (1.0E)
Sectorsize: 512
Mode: r1w1e1

So you can see, padlock is active with aes-cbc block cipher.....
Any solutions how to change the cipher mode for encrypted disks?

btw: on 64-bit freenas openssl isn´t using padlock
[root@freenas] ~# openssl engine
(cryptodev) BSD cryptodev engine
(dynamic) Dynamic engine loading support

it works fine on the 32-bit version of freenas

I hope you can help with this issue and I´m sure much people interested in it because padlock is really nice and has a great performance :) Thanks!

 

[dlavigne]

So you can see, padlock is active with aes-cbc block cipher.....
Any solutions how to change the cipher mode for encrypted disks?

Someone (possibly you?) opened a feature request for this.

btw: on 64-bit freenas openssl isn´t using padlock
it works fine on the 32-bit version of freenas

Please create a bug report regarding the 32/64-bit issue and post the issue number here.

 

[cyberjock]

Is the VIA chip even compatible with FreeBSD? Doesn't it need a kernel driver? AES-NI is the common one. Not sure if VIA has provided one for FreeBSD. Have you done any benchmarks to validate that it even works properly?

Edit: I'm a partial moron.. you even bolded it.. "HARDWARE"..

Still, what do the benchmarks say? Just wondering...

 

[cyberjock]

Something else(not a crypto wiz) but I thought AES-CBC was useless for disk based encryption because it required the previous blocks ciphertext. And then that block's ciphertext required you to know the previous block's ciphertext, ad nausea to the beginning of the disk.

 

[wipeout40k]

Someone (possibly you?) opened a feature request for this.



Please create a bug report regarding the 32/64-bit issue and post the issue number here.

Yes sir this was me ;)

Ok, as you wish, i created a ticket, here´s the url:

https://bugs.freenas.org/issues/3836