1libipsec-mb(7) Linux Programmer's Manual libipsec-mb(7)
2
6 libipsec-mb - overview of Intel(R) Multi-Buffer Crypto for IPSec li‐
7 brary
8
10 Intel Multi-Buffer Crypto for IPsec Library provides highly-optimized
11 software crypto implementations targeting packet processing applica‐
12 tions such as IPsec, TLS, Wireless (RAN), Cable and MPEG DRM and pro‐
13 vides industry-leading performance on a range of Intel(R) Processors.
14 The library offers API crafted for applications where a buffer is sub‐
15 ject of encryption and/or integrity operations.
16 For best processor utilization it uses multi buffer technology for al‐
17 gorithms that don't allow multi block processing.
18 See more in the Intel White Paper: "Fast Multi-buffer IPsec Implementa‐
19 tions on Intel Architecture Processors". Jim Guilford, Sean Gulley,
20 et. al.
21 The easiest way to find it is to search the Internet for the title.
22 More information can be found at intel-ipsec-mb
25 ⟨https://github.com/intel/intel-ipsec-mb⟩.
26 ENCRYPTION ALGORITHMS
29 AES128-GCM, AES192-GCM, AES256-GCM, AES128-CBC, AES192-CBC, AES256-CBC,
30 AES128-CTR, AES192-CTR, AES256-CTR, AES128-CCM, AES256-CCM, AES128-ECB,
31 AES192-ECB, AES256-ECB, NULL, AES128-DOCSIS, AES256-DOCSIS, DES-DOCSIS,
32 3DES, DES, KASUMI-F8, ZUC-EEA3, ZUC-EEA3-256, SNOW3G-UEA2, AES128-CBCS,
33 CHACHA20, CHACHA20 AEAD, SNOW-V, SNOW-V AEAD and PON-CRC-BIP.
34 INTEGRITY ALGORITHMS
37 AES-XCBC-96, HMAC-MD5-96, HMAC-SHA1-96, HMAC-SHA2-224_112, HMAC-
38 SHA2-256_128, HMAC-SHA2-384_192, HMAC-SHA2-512_256, AES128-GMAC,
39 AES192-GMAC, AES256-GMAC, NULL, AES128-CCM, AES256-CCM, AES128-CMAC-96,
40 AES256-CMAC-96, KASUMI-F9, ZUC-EIA3, ZUC-EIA3-256, SNOW3G-UIA2, DOCSIS-
41 CRC32, HEC, POLY1305, POLY1305 AEAD, SNOW-V AEAD, GHASH, PON-CRC-BIP as
42 well as multiple CRC types.
43 RECOMMENDATIONS
46 DES algorithm should be avoided and AES encryption should be used in‐
47 stead.
48 3DES is a legacy algorithms and AES encryption is recommended to use
49 instead.
50 HMAC-MD5-96 is a legacy algorithm and HMAC-SHA1 is recommended to use
51 instead.
52 DES, 3DES and HMAC-MD5-96 are implemented in the library to support
53 legacy applications.
54 AES-ECB algorithm should be avoided and AES-CBC or AES-CNTR encryption
55 should be used instead.
56 KEY STORAGE
59 The library doesn't offer any solution for secure key storage or stor‐
60 age of sensitive information. It is up to application to arrange safe
61 storage of sensitive information.
62 API
65 The library offers four sets of identical API's. Each set corresponds
66 to one architecture: SSE, AVX, AVX2 and AVX512.
67 It comprises of init_mb_mgr, get_next_job, submit_job, get_com‐
68 pleted_job and flush_job operations.
69 init_mb_mgr() - initializes the instance of the multi-buffer manager
70 get_next_job() - obtains pointer to next available job entry
71 submit_job() - submits job for processing
72 get_completed_job() - returns already completed jobs
73 flush_job() - flushes multi-buffer manager and completes any outstanding operations.
74 The basic usage of the API is presented by this pseudo code:
76 init_mb_mgr(&mb_mgr);
78 ...
79 while (work_to_be_done) {
80 job = get_next_job(&mb_mgr);
81 /* TODO: Fill in job fields */
82 job = submit_job(&mb_mgr);
83 while (job != NULL) {
84 /* TODO: Complete processing on job */
85 job = get_completed_job(&mb_mgr);
86 }
87 }
88 job = flush_job(&mb_mgr);
90 while (job != NULL) {
91 /* TODO: Complete processing on job */
92 job = flush_job(&mb_mgr);
93 }
94 The library provides more interface functions i.e. single block hash
96 functions for HMAC OPAD and IPAD calculations.
97
99 Report bugs at intel-ipsec-mb/issues ⟨https://github.com/intel/intel-
100 ipsec-mb/issues⟩.
101
104 Jim Guilford <james.guilford@intel.com>, Tomasz Kantecki <tomasz.kan‐
105 tecki@intel.com>
106 This is free software; see the source for copying conditions. There is
109 NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
110 PURPOSE.
111Linux 2018-03-01 libipsec-mb(7)