www/crypto.html - diff

Return to crypto.html CVS log

Up to [local] / www

Diff for /www/crypto.html between version 1.86 and 1.87

version 1.86, 2001/06/26 11:46:14

version 1.87, 2001/06/27 11:51:21

Line 79

OpenBSD was the first operating system to ship with an IPSEC stack.

OpenBSD was the first operating system to ship with an IPsec stack.

We've been including IPSEC since early OpenBSD 2.1 release in 1997.

We've been including IPsec since early OpenBSD 2.1 release in 1997.

Our fully conformant in-kernel IPSEC stack, with hardware acceleration

Our fully conformant in-kernel IPsec stack, with hardware acceleration

based on a number of cards, and our own free ISAKMP daemon, is used as

one of the machines in the IPSEC conformance testbed run by

one of the machines in the IPsec conformance testbed run by

<a href="http://www.vpnc.org">VPNC</a>.

Line 189

<li>Stronger temporary names for mktemp(3) and mkstemp(3)

<li>Randomness added to the TCP ISS value for protection against

spoofing attacks.

<li>random padding in IPSEC esp_old packets.

<li>random padding in IPsec esp_old packets.

<li>To generate salts for the various password algorithms.

<li>For generating fake S/Key challenges.

<li>In <a href=http://www.physnet.uni-hamburg.de/provos/photuris/>photurisd</a>

Line 216

<ul>

to provide one time passwords.

<li>In <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=ipsec>IPSEC</a>,

<li>In <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=ipsec>IPsec</a>,

<a href=http://www.physnet.uni-hamburg.de/provos/photuris/>photurisd</a>

and

<a href=http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd>isakmpd(8)</a>

Line 248

passwords. See also the <a href="papers/bcrypt-paper.ps">USENIX paper</a>

on this topic.

<li>In

<a href=http://www.openbsd.org/cgi-bin/man.cgi?query=ipsec>IPSEC</a>

<a href=http://www.openbsd.org/cgi-bin/man.cgi?query=ipsec>IPsec</a>

to provide confidentiality for the network layer.

<li>In Kerberos and a handful of kerberized applications, like

<a href=http://www.openbsd.org/cgi-bin/man.cgi?query=telnet>telnet</a>,

Line 260

photurisd</a> and

<a href=http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd>isakmpd</a>

to protect the exchanges where IPSEC key material is negotiated.

to protect the exchanges where IPsec key material is negotiated.

<li>In AFS to protect the messages passing over the network, providing

confidentiality of remote filesystem access.

<li>In libssl to let applications communicate over the de-facto standard

Line 274

OpenBSD, starting with 2.7, has begun supporting some cryptography hardware

such as accelerators and random number generators.

<ul>

<li>IPSEC crypto dequeue

<li>IPsec crypto dequeue

Our IPSEC stack has been modified so that cryptographic functions get

Our IPsec stack has been modified so that cryptographic functions get

done out-of-line. Most simple software IPSEC stacks need to do

done out-of-line. Most simple software IPsec stacks need to do

cryptography when processing each packet. This results in synchronous

performance. To use hardware properly and speedily one needs to separate

these two components, as we have done. Actually, doing this gains some

Line 294

stable. We wrote our own driver for supporting this chip, rather

than using the (USA-written)

<a href="http://www.powercrypt.com">powercrypt</a> driver, as well

our driver links in properly to the IPSEC stack.

our driver links in properly to the IPsec stack.

The 7751 is now considered slow by industry standards and many vendors

have faster chips (even HiFn now has a faster but more expensive

chip). Peak performance with 3DES SHA1 ESP is around 63MBit/sec.

Line 357

has now been integrated once we were able to get a free license on the

microcode. We have also received (all?) the information needed for

supporting the cryptographic functions, which will require a little bit of

IPSEC subsystem rearranging. Check back later..

IPsec subsystem rearranging. Check back later..

<li>Intel IPSEC card

<li>Intel IPsec card

Much like Intel does for all their networking division components, and

completely unlike most other vendors, Intel steadfastly refuse to provide

us with documentation. We have talked to about five technical people who

Line 376

Intel 82802AB/82802AC Firmware Hub RNG</a>

The 82802 FWH chip (found on i810, i820, i840, i850, and i860 motherboards)

contains a random number generator (RNG). High-performance IPSEC

contains a random number generator (RNG). High-performance IPsec

requires more random number entropy. As of April 10, 2000, we support

the RNG. We will add support for other RNG's found on crypto chips.