Hi, With IPSec ESP Authenc, it is expected that the selected driver generates "IV" as well as encrypts the data. Our 'hardware' (available currently), can only handle either no header processing or header processing (from ESP to IV processing but not individual field processing). For no header processing, we will have to do a lot more work in software - create a context SA for each requested operation, copy from the initial context SA, after the operation completed, retrieve the update IV from context SA, and then write it back to the packet. For header processing, tell hardware to skip IP header (- ESP header - IV), write SPI, SEQ, and IV. (This is all handled by hardware with the exception of compute the skipped length of IP header.) It does write the SPI and SEQ again but it is handled by the hardware and with the same value as software. Alternatinely, we can parse the IP header for the IP header length but this information is already available in IPSec statck, would not work with UDP encapsulation, and would be cleaner. -Loc -----Original Message----- From: linux-crypto-owner@xxxxxxxxxxxxxxx [mailto:linux-crypto-owner@xxxxxxxxxxxxxxx] On Behalf Of Herbert Xu Sent: Tuesday, May 27, 2008 11:35 PM To: Loc Ho Cc: linux-crypto@xxxxxxxxxxxxxxx Subject: Re: IPSec ESP Authenc Offload On Tue, May 27, 2008 at 11:29:22AM -0700, Loc Ho wrote: > > For authenc hardware offload outbound, we need to know the whole ESP > header length - IP header + UDP header + ESP header + IV. I am > thinking adding a field in struct aead_givcrypt_request as below: Could you please let me know why it needs this information? Is it doing ESP offload in addition to crypt/hash offload? Thanks, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
