Crypto Accelerator - force it

[tjchamp]

Is it possible to force encryption to the accelerator board?

[Martin Schoen]

tjchamp wrote:

> Is it possible to force encryption to the accelerator board?

Maybe.

More information might be useful.

Martin

[tjchamp]

Martin Schoen <noreply@vamosphoto.de> wrote in message news:<bg65ud$63n$04$1@news.t-online.com>...

> tjchamp wrote:
>

> > Is it possible to force encryption to the accelerator board?

>
> Maybe.
>
> More information might be useful.
>
> Martin

Not sure what additional info you are looking for. Just want to know
if there is a way to get all encryption handled on the hardware side
(Crypto Accelerator 1000). We are using iplanet web server 6.0, on
solaris 5.8.

[Darren J Moffat]

On Wed, 30 Jul 2003 08:08:00 -0700, tjchamp wrote:

> Not sure what additional info you are looking for. Just want to know
> if there is a way to get all encryption handled on the hardware side
> (Crypto Accelerator 1000). We are using iplanet web server 6.0, on
> solaris 5.8.

"All Encryption" No

The SCA-1000 only does RSA and 3DES in hardware the rest is done
in software. However the implementation of RC4 that ships with
the SCA-1000 is about 20% faster on SPARC than the naive C
implemention.

You can force the WebServer to use the SCA-1000 for all the SSL
algorithms. You should also configure the Webserver to only
support the SSL cipher suites that contain ciphers supported by
the SCA-1000 (basically RSA, DSA, 3DES, RC4)

IIRC the default configuration for the SCA-1000 does already
setup the WebServer to use it's PKCS#11 provider as the
prefered provider for the SSL cipher suite algorithms.

--
Darren J Moffat