Hardware — Cryptographic Accelerator Support (2024)

Cryptographic acceleration is available on some platforms, typically on hardwarethat has it available in the CPU like AES-NI, or built into the board such asthe ones used on Netgate ARM-based systems. Most cryptographic acceleratorhardware supported by FreeBSD will work, provided the drivers are in the kernelor available as loadable modules.

Note

Some modules and hardware are only supported by pfSense® Plus software.

Supported Devices

Currently supported cryptographic accelerator devices include:

AES-NI

Supported natively by most modern CPUs.

Intel QuickAssist Technology (QAT) [Plus only]

Supported on certain Intel-based platforms such as select models of c3000 andc2000 SoCs, and also by QAT add-on cards. Present on several Netgate hardwaremodels such as the 7100, 6100, 5100, and more.

CESA [Plus only]

Present on some ARM platforms such as the Netgate 3100.

SafeXcel [Plus only]

Present on some ARM platforms such as the Netgate 2100 and 1100.

Activating the Hardware

Some hardware acceleration is active at all times and there is no way to disableit short of removing the crypto card if it is a hardware add-on. For example,CESA acceleration cannot be disabled because it’s an integrated feature of thesystem and the drivers are present the kernel.

Others, such as QAT, AES-NI, or SafeXcel require choosing the appropriate moduleunder System > Advanced on the Miscellaneous tab (SeeCryptographic Hardware). Choose the appropriate module to match thehardware for Cryptographic Hardware and then Save. The module will be loadedand available immediately.

To deactivate a loaded module, select None for Cryptographic Hardware,Save, and then reboot the system.

Confirming Accelerator Use

Confirming that the cryptographic acceleration device is being used by thefirewall can be tricky, depending on the hardware in question.

Most often the evidence of cryptographic accelerator use is apparent in one ormore of the following observations:

  • Increased VPN throughput

  • Decreased system load (e.g. CPU utilization) for similar levels of VPNthroughput

In cases where it is not clear, some cryptographic accelerators show signs ofuse by checking for interrupt activity on the device using vmstat -i | grep<name>, where <name> corresponds to the name of the device:

QAT

Use the shell command vmstat -i | grep qat

CESA

Use the shell command vmstat -i | grep cesa

SafeXcel

Use the shell command vmstat -i | grep safexcel

In each of these cases, first check that there is any output at all. If thedevice has not been used at all since the firewall last rebooted or loaded thedevice driver, there will be no output from the command.

Note

To see if the driver is loaded, check kldstat -v | grep <name> to ensurethe driver is present, and check dmesg | grep <name> to see if the devicewas detected.

If there is output from vmstat -i for the device, check the third entry onthe line, which is the total number of interrupts observed on the device(s). Ifthis number is increasing with VPN activity, the device is being used by thefirewall. For example:

# vmstat -i | grep qatirq300: qat0 5481147 3

In that output the 5481147 number represents the number of interrupts on theqat0 device. Run the command again after transferring data across the VPN,and compare the number.

Note

If the command produces no output at all, the device is not being used or thedevice driver is not loaded.

Verifying Cipher Support

To see a list of engines and associated transforms supported by the hardware andactive modules though OpenSSL, run:

/usr/bin/openssl engine -t -c

Note

That is only for support via OpenSSL. Other areas such as IPsec may supportadditional methods not listed.

Practical Use

IPsec

IPsec will take advantage of acceleration automatically when an activeaccelerator supports the cipher chosen for a tunnel. For QAT and AES-NI, theoptimal cipher choice is AES-GCM.

OpenVPN

To take advantage of acceleration in OpenVPN, choose a supported cipher on eachend of a given tunnel.

Nothing needs selected for OpenVPN to utilize AES-NI. The OpenSSL engine has itsown code for handling AES-NI that works well without using additional modules.

Hardware — Cryptographic Accelerator Support (2024)

FAQs

What is cryptographic hardware acceleration? ›

Cryptographic hardware acceleration is the use of hardware to perform cryptographic operations faster than they can be performed in software. Hardware accelerators are designed for computationally intensive software code. Hardware accelerators to perform RSA operations.

What are hardware accelerators used for? ›

Hardware accelerators improve the execution of a specific algorithm by allowing greater concurrency, having specific datapaths for their temporary variables, and reducing the overhead of instruction control in the fetch-decode-execute cycle.

What is no hardware crypto acceleration? ›

"No Hardware Crypto Acceleration" is the default and counts as "no selection" CBC is accelerated but not optimal, try it with GCM and see if that's better. 128 is strong enough also instead of 256 if that works ok for ExpressVPN.

How do I enable Crypto in pfSense? ›

Enable Cryptographic Hardware Support
  1. Scroll down to “Cryptographic & Thermal Hardware”
  2. Click on “Cryptographic Hardware.”
  3. From the drop down, choose “AES-NI and BSD Crypto Device”
May 7, 2020

Should I turn off hardware acceleration? ›

Without hardware acceleration, most of these pages will stutter and freeze. Once you turn hardware acceleration on, you can enjoy digital fireworks, play around with a blob, or try solving a 3D Rubik's cube. Letting your CPU process and perform all tasks by itself greatly slows down your computer.

Should I have hardware accelerated on? ›

Is Hardware Acceleration Good or Bad? Hardware acceleration is good because it boosts performance for certain tasks. But sometimes, it may cause issues such as freezing or crashing in Google Chrome or other browsers, forcing you to disable the feature to fix the issue.

Should I turn off hardware acceleration Chrome? ›

However, depending on your device configuration, hardware acceleration can negatively affect your experience by preventing visual elements from displaying correctly on the screen. Disabling hardware acceleration can fix this issue if you're seeing menus and dialog boxes not rendering as expected.

Should I turn on hardware accelerated GPU scheduling? ›

Should You Enable GPU Hardware Scheduling? If your computer has a low or mid-tier CPU, the GPU hardware scheduling feature might be worth turning on. Especially if your CPU reaches 100% load in certain games.

How do I disable hardware accelerator? ›

Enter the OPTIONS command or choose it from the Application menu to open the Options dialog box. On the System tab, click the Graphics Performance button. Then click the Hardware Acceleration button to turn it off or on.

Does hardware acceleration improve performance? ›

Hardware acceleration is employed to improve application performance throughout a variety of fields, with applications including but not limited to: Computer graphics via Graphics Processing Unit (GPU) Digital signal processing via Digital Signal Processor.

Is a hardware crypto wallet necessary? ›

You do not need to own a hardware wallet in order to buy, store, or send bitcoin. But hardware wallets can significantly improve security by reducing the risk of your bitcoin being stolen. This article will provide you with a basic technical understanding of how hardware wallets protect your coins.

Should I turn off hardware acceleration edge? ›

If you get menus and dialog boxes not rendering correctly, a green screen appears when playing a video on Microsoft Edge, or there are rendering issues on a virtual machine, disabling hardware acceleration can resolve the problem.

Can pfSense block ransomware? ›

pfBlockerNG is an excellent Free and Open Source package developed for pfSense® software that provides advertisem*nt blocking and malicious content blocking, as well as geo-blocking capabilities. By installing pfBlockerNG, you can not only block ads but also web tracking, malware and ransomware.

Can you use pfSense as a VPN? ›

pfSense® software offers several VPN options: IPsec, OpenVPN, WireGuard and L2TP. This section provides an overview of VPN usage, the pros and cons of each type of VPN, and how to decide which is the best fit for a particular environment.

What is better than pfSense? ›

OPNsense has a nicer user interface and seems to implement new features faster than pfSense. pfSense has been around for longer, so the community is bigger, and there's more documentation online. IPFire has a less mature user interface, so we only recommend it if you already know it.

Does hardware acceleration affect RAM? ›

Because of the increased resources required to enable hardware acceleration, your app will consume more RAM.

Does hardware acceleration affect Internet speed? ›

One user on a forum saw their download speeds drop from 900 Mbps to 200 Mbps after disabling hardware acceleration on their router. This is common, and disabling hardware acceleration will most likely result in a drop in speeds and performance due to overworking the router's CPU.

Should I turn on hardware acceleration in Windows 10? ›

Hardware Acceleration is essential for gamers unless they play the pre-HD era games. With it enabled, the game would run at a higher framerate, the 3D rendering becomes slick, and game effects would be more precise.

Does hardware acceleration improve streaming? ›

Hardware-Accelerated Streaming has a number of advantages: More videos can often stream at the same time. Videos can start streaming faster and buffer less often. High-quality videos, especially 4K and HEVC videos, can stream more smoothly.

What is the purpose of hardware acceleration in Chrome? ›

Hardware acceleration works by moving some of the burden off of your PC's CPU onto the GPU, which can potentially resolve some processing problems by placing the page-rendering burden on the CPU. For this setting, click on the three-dot menu and open Settings.

Should I have hardware acceleration on in browser? ›

Hardware acceleration is a process by which applications offload or send certain commands and tasks to specialized hardware in your system to increase performance and reduce the load on the CPU. We recommend that hardware acceleration is turned on when you are using Showpad Video.

Should I turn off hardware acceleration for gaming? ›

The only reason not to enable hardware acceleration of any kind is if it doesn't work. The usual reason to turn it off is to make the system stable enough to get new drivers installed so you can turn it back on.

How do I optimize my PC for gaming? ›

How to optimise your PC for gaming
  1. Turn on gaming mode. Windows is already conveniently built for gaming. ...
  2. Disable notifications. ...
  3. Turn on Hardware-accelerated GPU scheduling. ...
  4. Adjust for best performance. ...
  5. Turn off enhanced pointer precision. ...
  6. Update your drivers. ...
  7. Turn on Nvidia G-Sync. ...
  8. Set your monitor refresh rate.
Aug 20, 2022

Does hardware acceleration use more power? ›

Hardware acceleration should for example use the GPU for some rendering tasks thereby using the CPU less and so being more efficient. That should be more energy efficient than just using a CPU as well. In some cases, this might cause the GPU to "go faster" and use more energy than it did, negating the benefit.

Why can't I turn off hardware acceleration? ›

In the Settings menu, expand the “Advanced” drop-down section found in the left sidebar and then select “System.” Find the “Use hardware acceleration when available” setting. Toggle the switch to the “Off” position and then click “Relaunch” to apply the changes.

What is cryptographic used for? ›

Cryptography provides for secure communication in the presence of malicious third-parties—known as adversaries. Encryption uses an algorithm and a key to transform an input (i.e., plaintext) into an encrypted output (i.e., ciphertext).

Should I enable hardware acceleration Windows 10? ›

Hardware Acceleration is essential for gamers unless they play the pre-HD era games. With it enabled, the game would run at a higher framerate, the 3D rendering becomes slick, and game effects would be more precise.

What is cryptographic key used for? ›

In cryptography, a key is a string of characters used within an encryption algorithm for altering data so that it appears random. Like a physical key, it locks (encrypts) data so that only someone with the right key can unlock (decrypt) it.

Do I need cryptographic services? ›

Cryptographic Services of Windows will help protect your data when sending it over public networks like the Internet. Such networks doesn't provide secure communication, and hence will make your data vulnerable to any third party that has intensions of reading or modifying your data.

How do hackers use cryptography? ›

It works by converting plain text into cipher text using some encryption algorithm at the sender's side and converting ciphertext into plain text at the receiver's. Cryptography is used to provide confidentiality, integrity, authenticity and non-repudiation.

Do hackers need to know cryptography? ›

To be able to crack passwords and encrypted protocols such as SSL and wireless, you need to at least be familiar with the concepts and terminology of cryptography and encryption. To many new hackers, all the concepts and terminology of cryptography can be a bit overwhelming and opaque.

When should you turn on hardware acceleration? ›

When to Use Hardware Acceleration. Hardware acceleration is employed to improve application performance throughout a variety of fields, with applications including but not limited to: Computer graphics via Graphics Processing Unit (GPU) Digital signal processing via Digital Signal Processor.

Should hardware accelerated GPU be on or off? ›

Should You Enable GPU Hardware Scheduling? If your computer has a low or mid-tier CPU, the GPU hardware scheduling feature might be worth turning on. Especially if your CPU reaches 100% load in certain games.

Does hardware acceleration use more battery? ›

If your watch face has long-running animations, using hardware acceleration can greatly lower the battery life of a device.

What are the 3 types of encryption keys? ›

Symmetric, or secret key encryption, uses a single key for both encryption and decryption. Symmetric key encryption is used for encrypting large amounts of data efficiently. 256-bit AES keys are symmetric keys. Asymmetric, or public/private encryption, uses a pair of keys.

What are the two main types of cryptographic? ›

There are two types of encryption in widespread use today: symmetric and asymmetric encryption. The name derives from whether or not the same key is used for encryption and decryption.

Top Articles
Latest Posts
Article information

Author: Lidia Grady

Last Updated:

Views: 6235

Rating: 4.4 / 5 (65 voted)

Reviews: 88% of readers found this page helpful

Author information

Name: Lidia Grady

Birthday: 1992-01-22

Address: Suite 493 356 Dale Fall, New Wanda, RI 52485

Phone: +29914464387516

Job: Customer Engineer

Hobby: Cryptography, Writing, Dowsing, Stand-up comedy, Calligraphy, Web surfing, Ghost hunting

Introduction: My name is Lidia Grady, I am a thankful, fine, glamorous, lucky, lively, pleasant, shiny person who loves writing and wants to share my knowledge and understanding with you.