Subject: RE: SSL Hardware acceleration questions . . .

From: lgazis <[email-masked]>
Date: Fri, 8 Mar 2002 11:03:26 -0800

I'm not sure how you tell, from the Apache end, whether Apache was built
with the engine version of OpenSSL or not.  I usually build with the engine
version, for the purpose of testing with hardware accelerator cards, so I
haven't checked that.  It might be in the documentation, or someone else on
the list may know.

The hardware accelerator card (CryptoSwift) that I was testing is made by
the company I work for, so I naturally have a vested interest in saying that
it provides plenty of benefit :-).  That said, I do have benchmark
information on how Apache fared, under various sorts of load, on various
systems, with and without the card, and also information on how I tweaked it
to get the maximum benefit from the card.  Contact me off the list if you
want more details.

Lynn Gazis
Rainbow Technologies

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Friday, March 08, 2002 2:16 AM
To: [email-masked]
Subject: RE: SSL Hardware acceleration questions . . .

Lynn,
     Thanx for your reply - I don't know if Oracle iAS (which uses
Apache/MOD_SSL/OpenSSL) uses the engine version, unfortunately as it is a
packaged product recompilation is not possible, I'll bung a call into
Oracle.  How do I identify if the engine version is in use? (I'll have a
look at the docs)
     How much benifit was the card?
Mikey

lgazis <[email-masked]> on 07/03/2002 21:48:29

Please respond to [email-masked]

To:   "[email-masked]'" <[email-masked]>
cc:

Subject:  RE: SSL Hardware acceleration questions . . .

Fairly easy.  For those hardware accelerators which are supported by the
OpenSSL engine version, all you need to do is to compile modSSL with the
engine version of OpenSSL (present as a separate version of OpenSSL from
OpenSSL 0.9.6 on), and include a line in httpd.conf setting SSLCryptoDevice
to the engine you wish to use.

I've set this up on Solaris, HP UX, AIX, Linux, and FreeBSD.

Lynn Gazis

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Thursday, March 07, 2002 9:37 AM
To: [email-masked]
Subject: SSL Hardware acceleration questions . . .

Dear all,
     Has anyone had any experience with hardware acceleration?
specifically:

How easy is it to get MOD_SSL to be configured with hardware SSL cards (any
cards to avoid/recommend).
We have Sun hardware (so Sun/Sonicwall ?)

Does anything need to be recompiled? which versions of OpenSSL are
supported etc.
Any specific experiences with iAS would be excellent.

What are the performance advantages?
Anything tio watch out for?

TIA
Mikey

All telephone calls are recorded and may be monitored.

E-mail communication is not secure and may be intercepted
by a third party. This message is confidential to the intended addressee.
If you are not the intended addressee, please inform us immediately and
then
delete this message. Virgin One account does not accept responsibility for
changes made to this message after it was sent. Although Virgin One account
believes this e-mail is free of any virus or other defect which may affect
a
computer, it is the responsibility of the recipient to ensure that it is
virus free and Virgin One account does not accept any responsibility for
any
loss or damage arising from its use.

The Virgin One account is a secured personal bank account with The Royal
Bank
of Scotland plc administered by Virgin Direct Personal Finance Ltd. It is
an
Introducer representative only of Virgin Money Personal Financial Service
Ltd,
which is authorised by the Financial Services Authority for life insurance,
pension and unit trust business and represents only the Virgin Money
marketing
group.

Registered office: Waterhouse Square, 138-142 Holborn, London EC1N 2TH, UK.
Registered in England no 3414708.
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Amir Abiri" <[email-masked]>
Date: Fri, 8 Mar 2002 21:09:51 +0200

From: "lgazis" <[email-masked]>

> with the engine version of OpenSSL or not.  

httpd -V ?

-- 
"God is a programmer".

---

From: "R. DuFresne" <[email-masked]>
Date: Fri, 8 Mar 2002 14:48:53 -0500 (EST)

If the tarball still exisits upon the server, the one would gain a clue
via ls;

openssl-engine-0.9.6b.tar.gz

If the tarball was rm'ed but the sources exist, again a search would tell;

/usr/local/src/installed/web/openssl-engine-0.9.6b/apps
/usr/local/src/installed/web/openssl-engine-0.9.6b/apps/apps.c
/usr/local/src/installed/web/openssl-engine-0.9.6b/apps/apps.h
/usr/local/src/installed/web/openssl-engine-0.9.6b/apps/apps.o
/usr/local/src/installed/web/openssl-engine-0.9.6b/apps/app_rand.c
/usr/local/src/installed/web/openssl-engine-0.9.6b/apps/app_rand.o
etc...

else one might get a clue via the ssl install location perhaps looking at
the include files I'm guessing here;

/usr/local/ssl/include/openssl/engine.h

I'm thinking if the engine version was not installed this header file
might be lacking, folks without the engine version will have to confirm.

of course, much of this stuff might well and should be missing from a
running exposed system.  but, I'm also guessing there are differences in
the sizes of the binaries that are generated, suspecting the engine
version to be somewhat larger.  I'm not going to take the time here to
build a non-engine version to verify, I'll leave that to someone else.
Additionally this might well give a clue, the maintainers of the openssl
code would beable to verify;

strings openssl|grep engine

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!