Only in /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0: .git diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/README.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/README.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/README.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/README.md 2026-03-26 11:50:20.000000000 +0000 @@ -12,8 +12,5 @@ Depending on the particular use case, the QAT_Engine can be configured to accelerate via the QAT Hardware or QAT Software or both based on the platform to meet your specific -acceleration needs. QAT_Engine supports both the **Engine** interface (all OpenSSL versions) -and the **Provider** interface (`qatprovider`, recommended for OpenSSL 3.x). Use -`--enable-qat_provider` at build time to enable the Provider interface; see -[OpenSSL v3 Provider Support](docs/qat_common.md#openssl-v3-provider-support) for details. +acceleration needs.

@@ -32,15 +29,14 @@ ## Installation Instructions -Installation instructions, including build steps for the Engine and Provider -interfaces across QAT_HW, QAT_SW and Co-existence configurations, are described [here](docs/install.md) +Installation instructions are described [here](docs/install.md) ## Testing +

-Verify QAT Engine and Provider loading - -### Verify QAT Engine loading +Test using OpenSSL Engine command +### Test using OpenSSL\* Engine command Run this command to verify the Intel® QAT OpenSSL\* Engine is loaded -correctly. This should not be used to determine QAT Engine capabilities as +correctly: This should not be used to determine QAT Engine capabilities as it will not display all the algorithms that are supported in QAT Engine. @@ -77,29 +73,11 @@ Detailed information about the engine specific messages is available [here](docs/engine_specific_messages.md). Also `./openssl engine -t -c -vvvv qatengine` gives brief description about each ctrl command. - -### Verify QAT Provider loading - -When built with `--enable-qat_provider`, run the following to verify `qatprovider` is -loaded correctly. Always load the `default` provider alongside `qatprovider` to ensure -complete algorithm coverage. - -```text -cd /path/to/openssl_install/bin -./openssl list -providers -provider qatprovider -provider default -``` - -Expected output will list `qatprovider` with its name, version and loaded status. - -> **Note:** Always activate the `default` provider alongside `qatprovider` — either via -> `-provider default` on the command line or by adding it to your `openssl.cnf`. -> See [OpenSSL Provider Support](docs/qat_common.md#openssl-provider-support) for details. +
-Test using OpenSSL* speed utility +Test using OpenSSL speed utility ### Test using OpenSSL\* speed utility -**QAT Engine (`-engine qatengine`)** - ```text cd /path/to/openssl_install/bin @@ -133,45 +111,12 @@ taskset -c 1 ./openssl speed -engine qatengine -elapsed -evp aes-128-gcm ``` +Note: Run the test without "-engine qatengine" for each algorithm to see the performance against OpenSSL. +This only covers key algorithms, additional algorithms can be tested by changing algo parameter. -**QAT Provider (`-provider qatprovider -provider default`)** - -```text -cd /path/to/openssl_install/bin - -qat_hw - -* RSA 2K Sign/Verify - taskset -c 1 ./openssl speed -provider qatprovider -provider default -elapsed -async_jobs 72 rsa2048 -* ECDH P-256 Compute Key - taskset -c 1 ./openssl speed -provider qatprovider -provider default -elapsed -async_jobs 72 ecdhp256 -* ECDSA P-256 Sign/Verify - taskset -c 1 ./openssl speed -provider qatprovider -provider default -elapsed -async_jobs 72 ecdsap256 -* AES-256-GCM - taskset -c 1 ./openssl speed -provider qatprovider -provider default -elapsed -async_jobs 72 -evp aes-256-gcm - -qat_sw - -* RSA 2K Sign/Verify - taskset -c 1 ./openssl speed -provider qatprovider -provider default -elapsed -async_jobs 8 rsa2048 -* ECDH X25519 Compute Key - taskset -c 1 ./openssl speed -provider qatprovider -provider default -elapsed -async_jobs 8 ecdhx25519 -* ECDSA P-256 Sign/Verify - taskset -c 1 ./openssl speed -provider qatprovider -provider default -elapsed -async_jobs 8 ecdsap256 -* AES-256-GCM - taskset -c 1 ./openssl speed -provider qatprovider -provider default -elapsed -evp aes-256-gcm -``` - -Note: Run the test without `-engine qatengine` or `-provider qatprovider` for each algorithm to -compare against OpenSSL\* software. This covers key algorithms; additional algorithms can be tested -by changing the algo parameter. Additional provider test commands are described in -[docs/qat_common.md](docs/qat_common.md#openssl-provider-support).
Test using inbuilt testapp utility -### Test using inbuilt testapp utility - -> **Note:** The `testapp` utility supports the QAT Engine (`qatengine`) interface only. -> It does not support the QAT Provider (`qatprovider`) interface. +## Test using inbuilt testapp utility ```text diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/dockerfiles/haproxy/Dockerfile /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/dockerfiles/haproxy/Dockerfile --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/dockerfiles/haproxy/Dockerfile 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/dockerfiles/haproxy/Dockerfile 2026-03-26 11:50:20.000000000 +0000 @@ -80,6 +80,4 @@ bison \ python3 \ - autoconf-archive \ - libnuma-dev \ wget && \ git clone --depth 1 -b $OPENSSL_VERSION https://github.com/openssl/openssl.git && \ @@ -159,12 +157,10 @@ apt-get upgrade -y -COPY --from=builder /usr/local/lib/libqat.so* /usr/local/lib/ -COPY --from=builder /usr/local/lib/libusdm.so* /usr/local/lib/ -COPY --from=builder /usr/local/lib/libIPSec_MB.so* /usr/lib/x86_64-linux-gnu/ -COPY --from=builder /usr/local/lib64/libcrypto.so* /usr/lib/x86_64-linux-gnu/ -COPY --from=builder /usr/local/lib/intel64/libcrypto_mb.so* /usr/lib/x86_64-linux-gnu/ -COPY --from=builder /usr/lib/x86_64-linux-gnu/libnuma.so* /usr/lib/x86_64-linux-gnu/ +COPY --from=builder /usr/local/lib/libqat.so.4.2.0 /usr/lib/ +COPY --from=builder /usr/local/lib/libusdm.so.0.1.0 /usr/lib/ +COPY --from=builder /usr/local/lib/libIPSec_MB.so.2.0.0 /usr/lib/x86_64-linux-gnu/ +COPY --from=builder /usr/local/lib64/libcrypto.so.3 /usr/lib/x86_64-linux-gnu/ +COPY --from=builder /usr/local/lib/intel64/libcrypto_mb.so.12.2 /usr/lib/x86_64-linux-gnu/ COPY --from=builder /usr/local/bin/openssl /usr/bin/ -COPY --from=builder /usr/local/lib64/libssl.so* /usr/lib/x86_64-linux-gnu/ COPY --from=builder /usr/local/lib64/engines-3/qatengine.so /usr/lib/x86_64-linux-gnu/engines-3/qatengine.so COPY --from=builder /etc/group /etc/group @@ -172,5 +168,4 @@ COPY --from=builder /usr/local/sbin/haproxy /usr/local/sbin/haproxy COPY --from=builder /usr/local/etc/haproxy/ /usr/local/etc/haproxy/ - RUN ldconfig diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/dockerfiles/haproxy/haproxy.cfg /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/dockerfiles/haproxy/haproxy.cfg --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/dockerfiles/haproxy/haproxy.cfg 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/dockerfiles/haproxy/haproxy.cfg 2026-03-26 11:50:20.000000000 +0000 @@ -1,3 +1,2 @@ - global insecure-fork-wanted @@ -25,5 +24,5 @@ #tcp-request session reject -bind :8080 ssl force-tlsv12 crt /opt/server-rsa2k.cert.pem +bind :8080 ssl force-tlsv12 crt /opt/atf/environments/server/install/haproxy-qat/haproxy_install/conf/haproxy.certs/server-rsa2k.cert.pem # monitor-uri / diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/dockerfiles/qat_crypto_base/Dockerfile /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/dockerfiles/qat_crypto_base/Dockerfile --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/dockerfiles/qat_crypto_base/Dockerfile 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/dockerfiles/qat_crypto_base/Dockerfile 2026-03-26 11:50:20.000000000 +0000 @@ -68,6 +68,4 @@ nasm \ autoconf \ - autoconf-archive \ - libnuma-dev \ automake \ cmake \ @@ -144,11 +142,9 @@ apt-get upgrade -y -COPY --from=builder /usr/local/lib/libqat.so* /usr/local/lib/ -COPY --from=builder /usr/local/lib/libusdm.so* /usr/local/lib/ -COPY --from=builder /usr/local/lib/libIPSec_MB.so* /usr/lib/x86_64-linux-gnu/ -COPY --from=builder /usr/local/lib64/libcrypto.so* /usr/lib/x86_64-linux-gnu/ -COPY --from=builder /usr/local/lib64/libssl.so* /usr/lib/x86_64-linux-gnu/ -COPY --from=builder /usr/lib/x86_64-linux-gnu/libnuma.so* /usr/lib/x86_64-linux-gnu/ -COPY --from=builder /usr/local/lib/intel64/libcrypto_mb.so* /usr/lib/x86_64-linux-gnu/ +COPY --from=builder /usr/local/lib/libqat.so.4.2.0 /usr/lib/ +COPY --from=builder /usr/local/lib/libusdm.so.0.1.0 /usr/lib/ +COPY --from=builder /usr/local/lib/libIPSec_MB.so.2.0.0 /usr/lib/x86_64-linux-gnu/ +COPY --from=builder /usr/local/lib64/libcrypto.so.3 /usr/lib/x86_64-linux-gnu/ +COPY --from=builder /usr/local/lib/intel64/libcrypto_mb.so.12.2 /usr/lib/x86_64-linux-gnu/ COPY --from=builder /usr/local/bin/openssl /usr/bin/ COPY --from=builder /usr/local/lib64/engines-3/qatengine.so /usr/lib/x86_64-linux-gnu/engines-3/ diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/apps.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/apps.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/apps.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/apps.md 2026-03-26 11:50:20.000000000 +0000 @@ -9,13 +9,17 @@ Follow the below link on how to enable Async mode Nginx\* with QAT Hardware and software -Acceleration using best known configuration. +Aceeleration using best known configuration. [Async mode for Nginx\*](https://intel.github.io/quickassist/qatlib/asynch_nginx.html) +### NGINX\* QUIC with QAT +Experimental QUIC support for NGINX\* with Intel® QAT Engine for +BoringSSL\* Library can be found [here](https://www.intel.com/content/www/us/en/content-details/737522/experimental-quic-support-for-nginx.html) + ### HAProxy\* with QAT HAProxy\* is a free, very fast and reliable reverse-proxy offering high availability, load balancing, and proxying for TCP and HTTP-based applications. -Follow the instructions from the HAProxy [INSTALL](https://github.com/haproxy/haproxy/blob/master/INSTALL) file -to build and install HAProxy. The validated release is listed in [Software Requirements](software_requirements.md#applications). Use `USE_PTHREAD_EMULATION=1` option in the make command which improves performance +Follow the instructions from HAProxy [Install](https://github.com/haproxy/haproxy/blob/master/INSTALL) +to build and install Haproxy. Use `USE_PTHREAD_EMULATION=1` option in the make command which improves performance utilizing HAProxy's much lighter locks replacing OpensSL\* Pthread locks. @@ -24,5 +28,4 @@ to utilize QAT Acceleration. -#### QAT Engine Configuration ```bash ssl-engine qatengine algo ALL @@ -30,13 +33,8 @@ ``` -#### QAT Provider Configuration -```bash -ssl-provider qatprovider -ssl-mode-async -``` - ## Case Studies +* [Intel® QuickAssist Technology and OpenSSL-1.1.0:Performance](https://www.intel.com/content/www/us/en/content-details/709581/intel-quickassist-technology-and-openssl-1-1-0-performance.html) * [Intel® QuickAssist Technology - NGINX\* Performance White Paper](https://networkbuilders.intel.com/solutionslibrary/intel-quickassist-technology-nginx-performance-white-paper) -* [Accelerate HAProxy\* with Intel QAT](https://builders.intel.com/solutionslibrary/accelerating-haproxy-with-intel-quickassist-technology) +* [Accelerate HAProxy\* with Intel QAT](https://www.intel.com/content/www/us/en/content-details/814574/accelerating-haproxy-with-intel-quickassist-technology.html) Other Application Integration and more case studies can be found at QAT link below diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/bssl_support.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/bssl_support.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/bssl_support.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/bssl_support.md 2026-03-26 11:50:20.000000000 +0000 @@ -18,6 +18,4 @@ so it needs to be linked in the BoringSSL\* Library. It may cause linking error while building with the system lack of that library. -* The QAT Provider (`qatprovider`) is not supported with BoringSSL\*. Only the QAT -Engine interface is available for BoringSSL\* builds. ## Requirements diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/config_options.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/config_options.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/config_options.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/config_options.md 2026-03-26 11:50:20.000000000 +0000 @@ -30,7 +30,8 @@ --with-openssl_install_dir=/usr/local/ssl - If using the system OpenSSL, this option is not required. - In this case qatengine.so is installed in the system engines directory - (e.g., `/usr/lib64/engines-3` for OpenSSL 3.x). + If your system already includes OpenSSL 1.1.1 library and devel package this + option is not required. + In this case qatengine.so is installed in the system enginesdir + (eg: /usr/lib64/engine-1.1). ``` @@ -108,17 +109,13 @@ --enable-qat_provider - Enables the QAT Provider (`qatprovider`) interface for OpenSSL 3.x. - The default, if not specified, is the Engine interface. -``` -Refer to [OpenSSL Provider Support](qat_common.md#openssl-provider-support) for supported algorithms and test examples. -``` + Enables Provider support instead of engine for OpenSSL. Valid only + when built against OpenSSL 3.0, default if not specified will use engine + interface. Currently RSA, ECDSA, ECDH, ECX and AES-GCM algorithms are + only supported (disabled by default). --enable-qat_fips Enables FIPS support when provider is enabled. Valid only - when built against OpenSSL 3.0.8 along with the flag `--enable-qat_provider`, + when built against OpenSSL 3.0 along with the flag `--enable-qat_provider`, (disabled by default). -``` -Refer to [FIPS 140-3 Certification](qat_common.md#fips-140-3-certification) for more details. -``` --disable-qat_hw_rsa/--enable-qat_hw_rsa diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/features.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/features.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/features.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/features.md 2026-03-26 11:50:20.000000000 +0000 @@ -23,5 +23,5 @@ * ChaCha20-Poly1305 * SM4-CBC -* Key Derivation +* Key Derivation * PRF * HKDF @@ -34,40 +34,30 @@ * [Key Protection Technology (KPT) Support using QAT_HW driver v2.0](qat_hw_kpt.md) -> **Algorithm default status:** -> - **Enabled by default:** RSA (2048–4096 on all platforms; up to 8192 on QAT Gen4/v2.x and intree), -> ECDH/ECDSA (curves ≥256-bit, X25519/X448), PRF, -> AES-256-CBC-HMAC-SHA256, AES-256-CCM (v2.x/intree only). -> - **Insecure — disabled by default** (enable with `--enable-qat_insecure_algorithms`): -> RSA (<2048), DSA, DH (all key sizes), ECDH/ECDSA on curves <256-bit (Binary/Koblitz), -> AES-128-GCM, AES-128/192-CCM, AES-128/256-CBC-HMAC-SHA1, AES-128-CBC-HMAC-SHA256, SHA3-224. -> - **Experimental — disabled by default** (enable with corresponding `--enable-qat_hw_*` flag): -> AES-256-GCM, HKDF, SHA3-256/384/512, ChaCha20-Poly1305, SM2, SM3. -> - **Tongsuo/BabaSSL only — disabled by default:** SM4-CBC. -> -> See [qat_hw_algo.md](qat_hw_algo.md) for the full per-platform default status and configure flags. +Please refer [here](qat_hw_algo.md) for applicable QAT Hardware versions and algorithms enabled by default. ## qat_sw Features -[Intel® QAT Software Acceleration](qat_sw.md) provides multi-buffer based acceleration -for the following algorithms: - -| QAT_SW Algorithm | Status | -| :--- | :---: | -| RSA 2048/3072/4096 | \* | -| ECDH X25519, P-256/P-384, SM2 | \* | -| ECDSA P-256/P-384, SM2 | \* | -| AES128-GCM, AES192-GCM, AES256-GCM | \* | -| SM4-CBC, SM4-GCM, SM4-CCM (16 multibuffer requests) | \# | -| SM3 (16 multibuffer requests) | \*\* | - -\* Enabled by default in the standard build.
-\# Disabled by default; applicable to Tongsuo/BabaSSL builds only.
-\*\* Disabled by default due to performance degradation in multithreaded scenarios; see [Known Issues](limitations.md#known-issues). +* [Intel® QAT Software Acceleration](qat_sw.md) +* Asymmetric PKE + * RSA for Key size 2048, 3072, 4096 + * ECDH for the following curves: + * Montgomery EC Curve: X25519 + * NIST Prime Curves: P-256/P-384 + * SM2 + * ECDSA for the following curves: + * NIST Prime Curves: P-256/P-384 + * SM2 +* Symmetric Ciphers + * AES128-GCM, AES192-GCM and AES256-GCM + * SM4-CBC using 16 Multibuffer requests (Tongsuo only) + * SM4-GCM using 16 Multibuffer requests (Tongsuo only) + * SM4-CCM using 16 Multibuffer requests (Tongsuo only) +* Hashing + * SM3 Hash using 16 Multibuffer requests (Experimental) ## Common Features to qat_hw & qat_sw * [BoringSSL Support](bssl_support.md) -* [OpenSSL Provider Support](qat_common.md#openssl-provider-support) +* [OpenSSL 3.0 Provider Support](qat_common.md#openssl-30-provider-support) * [QAT_HW & QAT_SW Co-existence](qat_coex.md#qat-hw-and-qat-sw-co-existence) * [FIPS 140-3 Certification](qat_common.md#fips-140-3-certification) -* [Hybrid PQC Interoperability](qat_common.md#interoperability-with-openssl-default-provider-for-hybrid-pqc) Note: RSA Padding schemes are handled by OpenSSL\* or BoringSSL\* rather than accelerated, so the diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/install.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/install.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/install.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/install.md 2026-03-26 11:50:20.000000000 +0000 @@ -40,5 +40,4 @@ - [Build QAT Engine for QAT_SW](#build-qat-engine-for-qat_sw) - [Build QAT Engine with QAT_HW & QAT_SW Co-existence ](#build-qat-engine-with-qat_hw--qat_sw-co-existence) -- [Build with QAT Provider Interface](#build-with-qat-provider-interface) - [Build Instructions for BoringSSL Library](bssl_support.md) @@ -102,14 +101,5 @@ export OPENSSL_ENGINES=/usr/local/ssl/lib64/engines-3 ``` - -For the QAT Provider, the `qatprovider.so` module must be placed in the OpenSSL\* -modules directory. Set `OPENSSL_MODULES` if the module is installed outside the -default location (e.g. `/lib64/ossl-modules/`): - -``` -export OPENSSL_MODULES=/usr/local/ssl/lib64/ossl-modules -``` - -Load/Initialize Engine or Provider using the OpenSSL conf file is located [here](openssl_config.md) +Load/Initialize Engine using the the OpenSSL conf file is located [here](openssl_config.md) ### Install QAT_HW & QAT_SW dependencies @@ -287,23 +277,5 @@ [here](qat_coex.md#qat_hw-and-qat_sw-co-existence) -### Build with QAT Provider Interface - -The QAT Provider (`qatprovider`) is the recommended interface for OpenSSL 3.x -applications. Add `--enable-qat_provider` to any of the build configurations -above to build `qatprovider.so` instead of (or alongside) the engine. - -After installation, `qatprovider.so` is placed in the OpenSSL\* modules -directory (`/lib64/ossl-modules/`). Set `OPENSSL_MODULES` -if using a non-default path: - -``` -export OPENSSL_MODULES=/usr/local/ssl/lib64/ossl-modules -``` - -Refer to [OpenSSL\* Configuration File](openssl_config.md) for loading the -provider via `openssl.cnf`, and to [qat_common.md](qat_common.md#openssl-v3-provider-support) -for test commands and further details. Note that when `qatprovider` is activated via -`openssl.cnf`, the `default` provider is not loaded automatically — ensure it is also -listed in the providers section to avoid "unknown algorithm" errors. +### Build Instructions for BoringSSL Library Refer [BoringSSL section](bssl_support.md) diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/limitations.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/limitations.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/limitations.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/limitations.md 2026-03-26 11:50:20.000000000 +0000 @@ -9,29 +9,27 @@ * **Event driven mode** of polling operation is not supported in the FreeBSD Operating system or in the qatlib RPM. -* QAT Engine does not support **ENCRYPT_THEN_MAC** (default) mode of operation, meaning - when Encrypt-then-MAC is negotiated for symmetric ciphers such as AES-CBC, the requests will not - be offloaded via QAT_HW; instead, OpenSSL SW is used. Disable ENCRYPT_THEN_MAC with the flag +* QAT Engine doesn't support **ENCRYPT_THEN_MAC**(default) mode of operation meaning + when Encrypt then MAC is negotiated for symmetric ciphers say AES-CBC, the requests will not + get offloaded via QAT_HW, instead uses OpenSSL SW. Disable ENCRYPT_THEN_MAC with the flag `SSL_OP_NO_ENCRYPT_THEN_MAC` programmatically using SSL_CTX_set_options() to offload - symmetric chained ciphers via QAT_HW. Please note that disabling ENCRYPT_THEN_MAC has security + symmetric chained ciphers via QAT_HW. Please note disabling ENCRYPT_THEN_MAC has security implications. -* OpenSSL 3.0.2 introduced a misleading error message (undefined symbol: **EVP_PKEY_get_base_id**) - during engine load which can be ignored as it is not a real failure. This was fixed in - OpenSSL\* 3.0.3. -* QAT Engine built for a given OpenSSL version is only compatible with dependent libraries also linked - with the same OpenSSL version due to [OpenSSL#17112](https://github.com/openssl/openssl/pull/17112). - This applies to OpenSSL 3.x builds. -* HKDF based on SM3 is not supported in QAT_HW. The request will fall back to OpenSSL software if - fallback is enabled; otherwise, failures are observed. +* OpenSSL 1.1.1n and OpenSSL 3.0.2 introduced misleading error message(undefined symbol: **EVP_PKEY_get_base_id**) + during engine load which can be ignored as it is not a real failure. This is later fixed in + OpenSSL\* 1.1.1o and OpenSSL\* 3.0.3 release. +* QAT Engine built for OpenSSL3.0 is only compatible with dependent libraries also linked with OpenSSL3.0 + libraries due to [OpenSSL#17112](https://github.com/openssl/openssl/pull/17112). Same applies for OpenSSL 1.1.1. +* HKDF based on SM3 is not supported in QAT_HW, The request will fallback to OpenSSL software if + fallback been enabled otherwise failures are observed. * There is a limitation with thread specific USDM: *memory allocated in one thread - should be freed only by the thread which allocates it*. When the QAT driver is configured - with `--enable-icp-thread-specific-usdm`, and when QAT_engine is used as the default - OpenSSL engine, it is required that OPENSSL_init_ssl() be called from the same thread that - calls OPENSSL_cleanup(). Incorrect cleanup can lead to a segmentation fault (segfault). - Also, memory allocated in a thread is freed automatically when the thread exits/terminates, + should be freed only by the thread which allocates it*. When the QAT driver is configured + with `--enable-icp-thread-specific-usdm`, and when QAT_engine is used as the default + OpenSSL engine, it is required that OPENSSL_init_ssl() be called from the same thread that + calls OPENSSL_cleanup(). Incorrect cleanup can lead to a segmentation fault (segfault). + Also, memory allocated in a thread is freed automatically when the thread exits/terminates, even if the user does not explicitly free the memory. * SVM mode is not supported with BoringSSL library and KPT mode. -* QAT_HW and QAT_SW Co-existence mode is not supported with BoringSSL\*. -* AES-CCM ciphers are not enabled in OpenSSL by default. They must be enabled manually using the openssl.cnf - section as below: +* AES-CCM ciphers are not enabled in OpenSSL by default. Need to enable it manually using the openssl.cnf + section as below ``` openssl_conf = cipher_conf @@ -67,38 +65,38 @@ ### Functional -* AES-CBC-HMAC-SHA chained ciphers do not support the **pipeline feature** when built with - OpenSSL 3.x as the corresponding support is not available in OpenSSL 3.x - +* AES-CBC-HMAC-SHA chained ciphers does not support **pipeline feature** when built with + OpenSSL 3.0 as the corresponding support is not available in OpenSSL 3.0 - [OpenSSL#18298](https://github.com/openssl/openssl/issues/18298) -* There is an issue in the **sshd** daemon application when using QAT with the default OpenSSL. - sshd closes the file descriptors associated with the QAT engine and driver after - initialising OpenSSL. A similar issue previously prevented the ability to ssh out of +* There is an issue in **sshd** daemon application when using the QAT for default openssl. + sshd looks to be closing the file descriptors associated with QAT engine and driver after + initialising openssl. Similar issue was present which prevents the ability to ssh out of the system using the QAT engine in versions of the ssh application before OpenSSH 8.7. - The issue has been fixed with this commit [c9f7bba](https://github.com/openssh/openssh-portable/commit/c9f7bba2e6f70b7ac1f5ea190d890cb5162ce127). - This update can be applied to sshd to work around the issue. + The issue has been fixed with this commit [c9f7bba](https://github.com/openssh/openssh-portable/commit/c9f7bba2e6f70b7ac1f5ea190d890cb5162ce127) + This update can be applied to sshd to work-around the issue. * Known issue with QAT_SW SM2 in `ntls` mode since QAT_SW SM2 doesn't have plain sign and verify operation support in engine. Disable QAT_SW SM2 to workaround the issue with ntls. No issues with TLS mode since it uses digestsign and digestverify which is supported. -* Known issue in Software fallback with OpenSSL 3.x Engine (only) when disabled via co-existence +* Known issue in Software fallback with OpenSSL3.0 Engine(only) when disabled via co-existence algo bitmap for algorithms PRF, HKDF, SM2 & SM3. QAT_HW PRF and QAT_HW HKDF are - not accelerated in OpenSSL 3.x engine due to the issue [OpenSSL#21627](https://github.com/openssl/openssl/discussions/21627) + not accelerated in OpenSSL 3.0 engine due to the issue [OpenSSL#21622](https://github.com/openssl/openssl/issues/21622) * Known issue in Co-existence mode with QAT provider on OpenSSL 3.2 and above during QAT_SW offload when QAT_HW modules are not present. * Known build issue with the latest commit of BoringSSL; hence, IPP Crypto 2021.10 should be used for the QAT engine with BoringSSL (use the BoringSSL commit mentioned in the Software requirements section). -* Known undefined symbol linking error when enabling QAT HW SM2 via `--enable-qat_hw_sm2` with - either the Engine (`qatengine`) or the Provider (`qatprovider`) build. ### Performance -* There is a known performance scaling issue (performance drop with threads >32) - with ECDSA ciphers in the QAT Software acceleration using multithread mode - in the HAProxy application. This issue is not observed when using RSA ciphers +* There is known performance scaling issue (performance drop with threads >32) + with ECDSA Ciphers in the QAT Software acceleration using multithread mode + in the Haproxy application. This issue is not observed when using RSA ciphers or in multi-process mode. -* SM3 is disabled by default due to a performance drop observed in **multithread scenarios** - for all cipher suites due to additional locks at engine_table_select introduced by +* SM3 is disabled by default due to performance drop observed in **multithread scenario** + for all ciphers suites due to the additional locks at engine_table_select introduced by engine digest registration in OpenSSL - [OpenSSL#18509](https://github.com/openssl/openssl/issues/18509) +* In Co-Existence mode, Performance is lower than QAT_SW only when process number >=64 due + to known issue. * Note regarding multithreaded performance with OpenSSL/*: In some cases, using QAT_Engine with OpenSSL at higher thread counts can produce *worse* performance, due to issues in the way OpenSSL - handles higher thread counts. Check for `native_queued_spin_lock_slowpath()` consuming CPU process + handles higher thread counts. Check for `native_queued_spin_lock_slowpath()` consuming CPU process idle time, and see the OpenSSL GitHub issues and web articles below. - + - Performance bottleneck with locks in engine_table_select() function - [OpenSSL#18509](https://github.com/openssl/openssl/issues/18509) - 3.0 performance degraded due to locking - [OpenSSL#20286](https://github.com/openssl/openssl/issues/20286) @@ -106,12 +104,8 @@ - https://superuser.com/questions/1737747/high-system-cpu-usage-on-linux -* Nginx Handshake Performance shows a known scaling behaviour in OpenSSL 3.x; the same - is observed with OpenSSL SW as well [OpenSSL#21833](https://github.com/openssl/openssl/issues/21833) +* Nginx Handshake Performance in OpenSSL3.0 is slightly slower compared to OpenSSL 1.1.1. The same + behaviour is observed in OpenSSL_SW as well [OpenSSL#21833](https://github.com/openssl/openssl/issues/21833) * Performance scaling is not linear in QAT2.0 supported platforms for ECDSA and Chacha-Poly algorithms. * Performance drop observed with ECDSAP256 algorithm in the OpenSSL speed tests with FreeBSD 14 intree driver. * Performance drop observed in QAT Engine with [async-nginx](https://github.com/intel/asynch_mode_nginx/tree/master) on FreeBSD OS with asymmetric and symmetric ciphers. * BoringSSL on FreeBSD OS is validated functionally with limited performance validation on Nginx QUIC POC. -* QAT_HW acceleration for **HKDF**, **ChaCha20-Poly1305**, and **AES-256-GCM** is experimental - and not recommended for production performance use cases. -* Performance drop observed with **ECDSA P-384** in QAT_HW and co-existence offload modes when using the Engine interface - (`qatengine`) compared to the Provider interface (`qatprovider`). diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/openssl_config.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/openssl_config.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/openssl_config.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/openssl_config.md 2026-03-26 11:50:20.000000000 +0000 @@ -32,5 +32,5 @@ For further details on using the OPENSSL_init_crypto function please see the OpenSSL\* online documentation located at: - + In order to start using the openssl.cnf file it needs some additional lines @@ -116,61 +116,5 @@ -# Using the OpenSSL\* Configuration File to Load/Initialize Providers - -OpenSSL\* 3.x introduced a provider model as the successor to the engine -interface. The Intel® QAT Provider (`qatprovider`) can be loaded via the -`openssl.cnf` file in the same way as engines, using the `providers` -configuration module instead of `engines`. The same application initialization -requirement applies: `OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL)` must -be called before any OpenSSL\* library call, as described in the engine section -above. - -As with engines, the global section of `openssl.cnf` must reference the -initialization section: - - openssl_conf = openssl_init - -The `openssl_init` section should register the `providers` module: - - [ openssl_init ] - providers = provider_section - -The `provider_section` lists the providers to be loaded. Both `qatprovider` and -the built-in `default` provider should be activated so that algorithms not -offloaded by QAT remain available: - - [ provider_section ] - qatprovider = qat_prov_section - default = default_sect - -The `qat_prov_section` contains the settings for the Intel® QAT Provider: - - [ qat_prov_section ] - module = /usr/local/lib64/ossl-modules/qatprovider.so - activate = 1 - -Where `module` is the path to the loadable shared library implementing the -provider. There is no need to specify this line if the provider module is -located within the standard OpenSSL\* modules directory (typically -`/lib64/ossl-modules/`). - -Where `activate = 1` instructs OpenSSL\* to load and initialise the provider. - -The default provider section should also be activated to ensure software -fallback for any algorithms not handled by the QAT Provider: - - [ default_sect ] - activate = 1 - -For further details on using the OpenSSL\* configuration file please see the -OpenSSL\* online documentation located at: - - -## TLS Application Integration - -Once `openssl.cnf` is configured to load either the Intel® QAT Engine or -the Intel® QAT Provider as described above, TLS applications such as async -mode NGINX\*, HAProxy\*, and the OpenSSL\* speed utility will automatically -benefit from QAT acceleration without requiring explicit `-engine qatengine` or -`-provider qatprovider` flags on the command line or in application-specific -configuration. +By setting up the configuration file as above it is possible for instance to run +the OpenSSL\* speed application to use the Intel® QAT OpenSSL\* Engine +without needing to specify `-engine qatengine` as a command line option. diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/qat_coex.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/qat_coex.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/qat_coex.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/qat_coex.md 2026-03-26 11:50:20.000000000 +0000 @@ -1,5 +1,5 @@ # QAT_HW and QAT_SW Co-existence -Intel® QAT OpenSSL\* Engine and Provider support QAT_HW and QAT_SW Co-existence +Intel® QAT OpenSSL\* Engine supports QAT_HW and QAT_SW Co-existence when both QAT_HW flag `--with-qat_hw_dir=/path/to/QAT_Driver` and QAT_SW flag `--enable-qat_sw` configured in the build configure @@ -17,57 +17,11 @@ For the algorithms RSA2K/3K/4K, ECDHP256/P384/X25519 & ECDSAP384 to reach -better performance, QATEngine uses both QAT_HW and QAT_SW for acceleration -when QAT_HW capacity is reached with co-existence build. The mechanism by which -QAT_HW capacity is detected differs between the two driver modes: - -**OOT (Out-of-Tree) driver:** QAT_HW signals capacity via a `RETRY` status -returned from the driver. When a `RETRY` is received, the request is transparently -rerouted to QAT_SW. The control flow for this mode is illustrated below. - -```mermaid -flowchart TD - A([Crypto Request]) --> B[Submit to QAT_HW] - B --> C{QAT_HW\nResponse?} - C -- Success --> D([Return Result]) - C -- RETRY --> E[Route to QAT_SW] - E --> F[Process via\nQAT_SW multibuffer] - F --> D - - style A fill:#dae8fc,stroke:#6c8ebf,color:#000000 - style D fill:#dae8fc,stroke:#6c8ebf,color:#000000 - style B fill:#fff2cc,stroke:#d6b656,color:#000000 - style E fill:#fff2cc,stroke:#d6b656,color:#000000 - style F fill:#fff2cc,stroke:#d6b656,color:#000000 - style C fill:#f8cecc,stroke:#b85450,color:#000000 -``` - -**Intree driver (`QAT_HW_INTREE`):** Instead of relying on `RETRY`, the -`icp_sal_AsymGetInflightRequests()` API provided by the intree driver is invoked -to query the number of in-flight requests currently outstanding on the QAT_HW -device. When this count reaches a configured threshold, subsequent requests are -offloaded to QAT_SW rather than being submitted to QAT_HW, achieving co-existence -without needing to wait for an explicit `RETRY` response from the hardware. - -```mermaid -flowchart TD - A([Crypto Request]) --> B[icp_sal_AsymGetInflightRequests] - B --> C{Inflight count\n< threshold?} - C -- Yes --> D[Submit to QAT_HW] - C -- No --> E[Route to QAT_SW] - D --> F{QAT_HW\nComplete?} - F -- Success --> G([Return Result]) - F -- Error --> E - E --> H[Process via\nQAT_SW multibuffer] - H --> G - - style A fill:#dae8fc,stroke:#6c8ebf,color:#000000 - style G fill:#dae8fc,stroke:#6c8ebf,color:#000000 - style B fill:#fff2cc,stroke:#d6b656,color:#000000 - style D fill:#fff2cc,stroke:#d6b656,color:#000000 - style E fill:#fff2cc,stroke:#d6b656,color:#000000 - style H fill:#fff2cc,stroke:#d6b656,color:#000000 - style C fill:#f8cecc,stroke:#b85450,color:#000000 - style F fill:#f8cecc,stroke:#b85450,color:#000000 -``` +better performance, QAT Engine uses both QAT_HW and QAT_SW for acceleration +when QAT_HW capacity is reached with co-existence build. The Control flow is +mentioned in the Figure below. + +

+drawing +

## Recommended settings and working mechanism @@ -80,12 +34,8 @@ reached, it will be processed through QAT_SW. These algorithms include: `RSA-2K/3K/4K`, `ECDSA-P384`, `ECDH-P256/P384/X25519`, `SM4-CBC(2048-16384 bytes)`. - - > **Note:** `SM4-CBC` co-existence (HW + SW) is supported with the **OOT driver only**. - > It relies on the QAT_HW `RETRY` mechanism to trigger QAT_SW fallback. - > SM4-CBC co-existence is **not supported** with the intree driver (`QAT_HW_INTREE`). 3. It is recommended to set "LimitDevAccess" to 0 in QAT_HW driver config file to utilize all the available device per process for Co-existence mode to fully utilize QAT_HW first and then utilize QAT_SW. -4. For SM4-CBC (**OOT driver only**), It is recommended to set "CyNumConcurrentSymRequests" to be +4. For SM4-CBC, It is recommended to set "CyNumConcurrentSymRequests" to be smaller to trigger QAT HW `RETRY`. And The number of async jobs should be appropriate, Number of async requests has to be maintained properly to @@ -103,8 +53,4 @@ ## Run time configuration using HW & SW algorithm bitmap - -> **Note:** This section is applicable to the **QAT Engine** (`qatengine`) module only -> and does not apply to the QAT Provider (`qatprovider`). - Intel® QAT OpenSSL\* Engine supports a runtime mechanism to dynamically choose the QAT_HW or QAT_SW or both for each algorithm using the ENGINE ctrl commands: @@ -123,8 +69,8 @@ | HKDF | 0x00100 | HW | | SM2(ECDSA) | 0x00200 | HW > SW | -| AES-GCM | 0x00400 | Both (SW > HW) | -| AES-CBC-HMAC-SHA | 0x00800 | HW | -| SM4-CBC | 0x01000 | Both (HW > SW) | -| CHACHA-POLY | 0x02000 | HW | +| AES_GCM | 0x00400 | Both (SW > HW) | +| AES_CBC_HMAC_SHA | 0x00800 | HW | +| SM4_CBC | 0x01000 | Both (HW > SW) | +| CHACHA_POLY | 0x02000 | HW | | SHA3 | 0x04000 | HW | | SM3 | 0x08000 | SW | @@ -139,5 +85,5 @@ 2. Enabled in [default algorithm] directive, e.g., `RSA/EC/DH/DSA/CIPHER/PKEY/DIGEST/ALL`. -Algorithms that are enabled in HW_ALGO_BITMAP will be accelerated via QAT_HW method and algorithms that are enabled in SW_ALGO_BITMAP will be accelerated via QAT_SW method. If an algorithm is enabled in both HW_ALGO_BITMAP and SW_ALGO_BITMAP then the one that has highest priority (listed above) will be accelerated. If none is enabled, OpenSSL SW will be used. +Algorithms that are enabled in HW_ALGO_BITMAP will gets accelerated via QAT_HW method and algorithms that are enabled in SW_ALGO_BITMAP will gets accelerated via QAT_SW method. If an algorithm is enabled in both HW_ALGO_BITMAP and SW_ALGO_BITMAP then the one that has highest priority (listed above) will be accelerated. If none is enabled, OpenSSL SW will be used. **Note:** diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/qat_common.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/qat_common.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/qat_common.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/qat_common.md 2026-03-26 11:50:20.000000000 +0000 @@ -1,27 +1,12 @@ -# OpenSSL Provider Support +# OpenSSL 3.0 Provider Support -Intel® QAT OpenSSL\* Engine supports both the legacy Engine interface and the -OpenSSL 3.x Provider interface (`qatprovider`) in production environments. -The Provider interface is the recommended integration point for OpenSSL 3.x -applications and offers the same QAT acceleration capabilities as the Engine -interface. Provider support can be enabled using the configure flag -`--enable-qat_provider`; the default, if not specified, is the Engine interface. - -Example commands to test using qatprovider: - -> **Note:** If `qatprovider.so` is not installed in the default OpenSSL\* modules -> directory (`/lib64/ossl-modules/`), add -> `-provider-path /path/to/ossl-modules` before `-provider qatprovider` in all -> commands below. - -> **Note:** When loading `qatprovider` explicitly, always also load the OpenSSL\* -> `default` provider (add `-provider default` to command-line invocations, or -> activate `[default_sect]` in `openssl.cnf`). The `default` provider supplies -> algorithms not offloaded by QAT (e.g. certificate parsing, key encoding, -> digest algorithms used internally). Omitting it can cause unexpected failures. - -> **Note:** When QAT HW or SW offload is supported and enabled on the platform, -> `qatprovider` takes the highest priority over all other stacked providers for -> the algorithms it offloads. +Intel® QAT OpenSSL\* Engine supports Provider interface for OpenSSL 3.0. +The qatprovider support can be enabled using configure flag `--enable-qat_provider` +and the default if not specified will use engine interface. + +This support is added as an experimental feature and with limited functional +testing with real time application like Nginx and Haproxy. + +Example OpenSSL Speed command to test using qatprovider: * QAT_HW @@ -30,170 +15,4 @@ ./openssl speed -provider qatprovider -elapsed -async_jobs 8 rsa2048 -**RSA Sign/Verify:** -``` -./openssl genrsa -provider qatprovider -out rsa_key.pem 2048 -./openssl dgst -provider qatprovider -sha256 -sign rsa_key.pem -out sig.bin plain.txt -./openssl dgst -provider qatprovider -sha256 -verify <(./openssl rsa -in rsa_key.pem -pubout) -signature sig.bin plain.txt -``` - -**ECDSA Sign/Verify (P-256):** -``` -./openssl genpkey -provider qatprovider -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ec_key.pem -./openssl dgst -provider qatprovider -sha256 -sign ec_key.pem -out ec_sig.bin plain.txt -./openssl dgst -provider qatprovider -sha256 -verify <(./openssl pkey -in ec_key.pem -pubout) -signature ec_sig.bin plain.txt -``` - -**AES-GCM Encrypt/Decrypt:** -``` -./openssl enc -provider qatprovider -aes-256-gcm -pbkdf2 -in plain.txt -out enc.bin -./openssl enc -provider qatprovider -aes-256-gcm -pbkdf2 -d -in enc.bin -out dec.txt -``` - -**TLS Handshake (s_server / s_client):** -``` -# Server -./openssl s_server -provider qatprovider -cert server.crt -key server.key -port 4433 & -# Client -./openssl s_client -provider qatprovider -connect localhost:4433 -``` - -## Interoperability with OpenSSL Default Provider for Hybrid PQC - -`qatprovider` supports hybrid post-quantum cryptography (PQC) by stacking with a second -provider that supplies PQC algorithms. QAT accelerates the classical component -(e.g. ECDH P-256/P-384, RSA, AES-GCM) while the PQC provider supplies the -post-quantum component (ML-KEM, ML-DSA). Two configurations have been tested: - -| Configuration | OpenSSL Version | PQC Provider | -| :--- | :---: | :--- | -| [OpenSSL 3.5.x built-in](#option-1-openssl-35x-built-in-default-provider) | 3.5.x | Built-in `default` provider (ML-KEM, ML-DSA) | -| [liboqs + oqs-provider](#option-2-openssl-34x-with-liboqs--oqs-provider) | 3.x (≤3.4.x) | [`oqs-provider`](https://github.com/open-quantum-safe/oqs-provider) backed by [`liboqs`](https://github.com/open-quantum-safe/liboqs) | - ---- - -### Option 1: OpenSSL 3.5.x built-in default provider - -OpenSSL 3.5.x ships ML-KEM and ML-DSA natively in its `default` provider — no -additional libraries are needed. - -**openssl.cnf — stacked provider configuration:** -```ini -openssl_conf = openssl_init - -[openssl_init] -providers = provider_section - -[provider_section] -qatprovider = qat_prov_section -default = default_sect - -[qat_prov_section] -module = /usr/local/lib64/ossl-modules/qatprovider.so -activate = 1 - -[default_sect] -activate = 1 -``` - -**Test hybrid KEM speed:** -```bash -./openssl speed -provider qatprovider -provider default \ - -elapsed X25519MLKEM768 p256_mlkem768 -``` - -**TLS handshake with hybrid KEM groups:** -```bash -# Server -./openssl s_server \ - -provider qatprovider -provider default \ - -cert server.crt -key server.key -port 4433 \ - -groups X25519MLKEM768:p256_mlkem768:X25519 & - -# Client -./openssl s_client \ - -provider qatprovider -provider default \ - -connect localhost:4433 \ - -groups X25519MLKEM768:p256_mlkem768:X25519 -``` - -**Generate a hybrid key and self-signed certificate (hybrid signatures):** -```bash -./openssl genpkey \ - -provider qatprovider -provider default \ - -algorithm p256_mldsa44 -out hybrid_key.pem - -./openssl req -new -x509 \ - -provider qatprovider -provider default \ - -key hybrid_key.pem -out hybrid_cert.pem \ - -subj "/CN=QAT Hybrid Test" -``` - -**TLS handshake with hybrid signature authentication:** -```bash -# Server -./openssl s_server \ - -provider qatprovider -provider default \ - -cert hybrid_cert.pem -key hybrid_key.pem -port 4433 & - -# Client -./openssl s_client \ - -provider qatprovider -provider default \ - -connect localhost:4433 \ - -CAfile hybrid_cert.pem -``` - ---- - -### Option 2: OpenSSL 3.4.x with liboqs + oqs-provider - -For OpenSSL versions prior to 3.5.x, use [`liboqs`](https://github.com/open-quantum-safe/liboqs) -and [`oqs-provider`](https://github.com/open-quantum-safe/oqs-provider) to supply PQC algorithms. -Build and install them following the [oqs-provider build instructions](https://github.com/open-quantum-safe/oqs-provider#building-and-installing). - -**openssl.cnf — stacked provider configuration:** -```ini -openssl_conf = openssl_init - -[openssl_init] -providers = provider_section - -[provider_section] -qatprovider = qat_prov_section -oqsprovider = oqs_prov_section -default = default_sect - -[qat_prov_section] -module = /usr/local/lib64/ossl-modules/qatprovider.so -activate = 1 - -[oqs_prov_section] -module = /usr/local/lib64/ossl-modules/oqsprovider.so -activate = 1 - -[default_sect] -activate = 1 -``` - -**Test hybrid KEM speed:** -```bash -./openssl speed -provider qatprovider -provider oqsprovider -provider default \ - -elapsed X25519_kyber768 p256_kyber768 -``` - -**TLS handshake with hybrid KEM groups:** -```bash -# Server -./openssl s_server \ - -provider qatprovider -provider oqsprovider -provider default \ - -cert server.crt -key server.key -port 4433 \ - -groups X25519_kyber768:p256_kyber768:X25519 & - -# Client -./openssl s_client \ - -provider qatprovider -provider oqsprovider -provider default \ - -connect localhost:4433 \ - -groups X25519_kyber768:p256_kyber768:X25519 -``` - # FIPS 140-3 Certification @@ -201,14 +20,14 @@ Certification requirements using QAT Provider against OpenSSL 3.0.8. The FIPS support can be enabled using the configure flag `--enable-qat_fips` only with -OpenSSL 3.0.8 using the provider interface, which must be enabled using `--enable-qat_provider`. +OpenSSL 3.0 using provider interface which needs to be enabled using `--enable-qat_provider`. -When the FIPS flag is enabled along with the provider for OpenSSL 3.0.8, it will run -self-tests and integrity tests and will satisfy other FIPS 140-3 CMVP & CAVP -requirements. The FIPS build is packaged as an RPM using the specfile `fips/qatengine_fips.spec` -with QAT_HW & QAT_SW Co-existence enabled along with other required flags. - -The Intel® QAT OpenSSL\* Engine (version v1.3.1) has obtained FIPS 140-3 -Level-1 certification. The certificate is available at the -[NIST CMVP Certificate #5032](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5032). +When FIPS flag is enabled along with provider for OpenSSL3.0, it will run +self tests, integrity tests and will satisfy other FIPS 140-3 CMVP & CAVP +requirements. The FIPS is build as RPM using the specfile fips/qatengine_fips.spec +with QAT_HW & QAT_SW Coexistence enabled along with other flags enabled. + +Please note that the version v1.3.1 is only satisfying FIPS 140-3 Level-1 +certification requirements and not FIPS certified yet. +The FIPS 140-3 certification is under process. ## Support Algorithms in FIPS mode @@ -227,5 +46,5 @@ it will accelerate via QAT_HW for asymmetic PKE and QAT_SW for AES-GCM and supported only on [Intel® Xeon® Scalable Processor family with Intel® QAT Gen4/Gen4m][1] with default build configuration -in QAT Engine against OpenSSL 3.0 engine and can be built using the `make rpm_oot` target. +in QAT Engine against OpenSSL 3.0 engine and can be build using `make rpm` target. Dependent library versions used for building binary package are mentioned in Software requirements section. diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/qat_hw.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/qat_hw.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/qat_hw.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/qat_hw.md 2026-03-26 11:50:20.000000000 +0000 @@ -19,5 +19,5 @@ Hardware accelerator ignoring the small packet offload threshold. Please refer to the OpenSSL\* manual for more information about pipelining. - + # Intel® QAT OpenSSL\* Engine Software Fallback @@ -56,5 +56,5 @@ 1. This Intel® QAT OpenSSL\* Engine supports the Intel® QAT Driver Heartbeat feature on the following QAT Enabled Devices or Platforms using -the driver Linux Hardware v1.7, v1.8, v2.x(qatlib intree) and FreeBSD Hardware +the driver Linux Hardware v1.7, v1.8, v2.0(qatlib intree) and FreeBSD Hardware v2.0(OOT package) @@ -77,6 +77,6 @@ and change the driver config files `/etc/.conf` to have `AutoResetOnError = 1` as mentioned above. Driver needs to be built with same -version of OpenSSL as the application, to meet OpenSSL's requirement of version compatibility. -Set the below envs to compile Driver against the same version of OpenSSL if needed. +version of OpenSSL as the application, to meet OpenSSL's requirement of version compatibility +between OpenSSL 1.1.1 and 3.x. Set the below envs to compile Driver against same version of OpenSSL if needed. * `setenv LDFLAGS "-L/lib"` diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/qat_hw_algo.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/qat_hw_algo.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/qat_hw_algo.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/qat_hw_algo.md 2026-03-26 11:50:20.000000000 +0000 @@ -1,5 +1,5 @@ # QAT_HW Algorithms list, its supported platforms and default behaviour -| QAT_HW Algorithms | v1.7 | v1.8 | v2.x | qatlib(intree) | +| QAT_HW Algorithms | v1.7 | v1.8 | v2.0 | qatlib(intree) | | :---: | :---: | :---: | :---: | :---: | | RSA Key size < 2048 | ** | ** | ** | ** | diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/software_requirements.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/software_requirements.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/software_requirements.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/software_requirements.md 2026-03-26 11:50:20.000000000 +0000 @@ -12,26 +12,19 @@ ## QAT_HW Drivers: -* [Intel® QuickAssist Technology Driver for Linux\* HW Version 2.0][4] - **QAT20.L.1.2.30-00109** +* [Intel® QuickAssist Technology Driver for Linux\* HW Version 2.0][4] - **QAT20.L.1.2.30-00090** * [Intel® QuickAssist Technology Driver for Linux\* HW Version 1.x][5] - **QAT.L.4.28.0-00004** * Intel® QuickAssist Technology Driver for FreeBSD\* HW Version 1.x and 2.0 - **QAT.B.3.14.31-00003** (FreeBSD 13.2) -* [Intel® QATlib for Linux with intree driver][7] - **QATlib 26.02.0** -* [Intel® QATlib for FreeBSD with intree driver(FreeBSD 14)][8] - **FreeBSD QATlib 26.02.0** (FreeBSD 14) +* [Intel® QATlib for Linux with intree driver][7] - **QATlib 24.09.0** & **QATlib 24.02.0** (for Dockerfile only) +* [Intel® QATlib for FreeBSD with intree driver(FreeBSD 14)][8] - **FreeBSD QATlib 23.09.0** (FreeBSD 14) ## QAT_SW Libraries: -* [Intel® Crypto Multi-buffer library][2] - **IPP Crypto v1.3.0** +* [Intel® Crypto Multi-buffer library][2] - **IPP Crypto v1.2.0** & **IPP Crypto 2021.10** (for BoringSSL only) * [Intel® Multi-Buffer crypto for IPsec Library release version][3] **v2.0** ## Crypto Libraries: -* [OpenSSL\*][9] 3.0.19, 3.2.6, 3.3.5, 3.4.3 & 3.5.5 -* BoringSSL\* - [0.20250415.0][10] +* [OpenSSL\*][9] 3.0.16, 3.2.4, 3.3.3, 3.4.1 & 3.5.0 +* BoringSSL\* commit - [23ed9d3][10] * [Tongsuo][11] - 8.4.0 (BabaSSL) -## Applications: -* [HAProxy\*][12] - **v3.3.0** - -## Optional Libraries (for Hybrid PQC interoperability): -* [liboqs][13] - Open Quantum Safe library (required for `oqs-provider`) -* [oqs-provider][14] - OpenSSL provider for post-quantum algorithms (alternative to OpenSSL 3.5.x built-in PQC) - [1]:https://www.intel.com/content/www/us/en/developer/topic-technology/open/quick-assist-technology/overview.html [2]:https://github.com/intel/cryptography-primitives/tree/develop/sources/ippcp/crypto_mb @@ -43,7 +36,4 @@ [8]:https://github.com/intel/qatlib-freebsd [9]:https://github.com/openssl/openssl -[10]:https://github.com/google/boringssl/releases/tag/0.20250415.0 +[10]:https://github.com/google/boringssl/commit/23ed9d3852bbc738bebeaa0fe4a0782f91d7873c [11]:https://github.com/Tongsuo-Project/Tongsuo -[12]:https://github.com/haproxy/haproxy/releases/tag/v3.3.0 -[13]:https://github.com/open-quantum-safe/liboqs -[14]:https://github.com/open-quantum-safe/oqs-provider diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/troubleshooting.md /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/troubleshooting.md --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/docs/troubleshooting.md 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/docs/troubleshooting.md 2026-03-26 11:50:20.000000000 +0000 @@ -36,18 +36,9 @@ * Has the environment variable `OPENSSL_ENGINES` been correctly defined and exported to the shell? Also check it is really pointing to the correct location. -* For the QAT Provider, has the environment variable `OPENSSL_MODULES` been -correctly defined and exported to point to the directory containing -`qatprovider.so`? The default location is `/lib64/ossl-modules/`. -If not set, OpenSSL\* will only search the compiled-in default modules path. -* When using `qatprovider`, ensure the OpenSSL\* `default` provider is also -explicitly activated — either via `-provider default` on the command line or -`activate = 1` under `[default_sect]` in `openssl.cnf`. Without it, algorithms -not handled by `qatprovider` (e.g. certificate parsing, internal digest -operations) will fail with `unknown algorithm` or `no provider` errors. * If building from OpenSSL prebuilt RPM Package, has the OpenSSL development packages (openssl-devel for Redhat\* based distribution and libssl-devel for Debian\* based distribution) been installed ? -* In case of qat_sw acceleration, check that the dependent libraries are installed -in the default path or provide the path via `--with-qat_sw_crypto_mb_install_dir` +* In case of qat_sw acceleration, has the dependent libraries are installed in +the default path or provide the path via `--with-qat_sw_crypto_mb_install_dir` (for crypto_mb) and `--with-qat_sw_ipsec_mb_install_dir` (for ipsec_mb) if installed in the path other than default. @@ -66,16 +57,2 @@ If you prefer to use these algorithms, Rebuild QAT_HW using `--enable-legacy-algorithms` and QAT Engine using `--enable-qat_insecure_algorithms` configure option. -* **System-wide `openssl.cnf` changes affect all OpenSSL applications including OpenSSH.** -When `qatprovider` or `qatengine` is activated in the system `openssl.cnf`, every -OpenSSL-based application on the host — including `sshd` and `ssh` — will load and -use QAT for its crypto operations. QAT hardware has a finite number of crypto instances; -SSH sessions consuming those instances can leave your target application (e.g. NGINX, -HAProxy) with fewer available instances, causing performance degradation or -`QAT HW initialization Failed` errors that appear unrelated to SSH activity. - - To avoid this, prefer scoping the configuration to your application rather than - modifying the system-wide `openssl.cnf`: - ```bash - # Set per-application via environment variable instead of system openssl.cnf - export OPENSSL_CONF=/path/to/your/app-specific/openssl.cnf - ``` diff -U2 -r /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/qatengine.spec /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/qatengine.spec --- /var/lib/copr-rpmbuild/results/qatengine/upstream-unpacked/Source0/QAT_Engine-2.1.0/qatengine.spec 2026-04-10 09:56:45.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0/qatengine.spec 2026-03-26 11:50:20.000000000 +0000 @@ -79,13 +79,4 @@ %changelog -* Thu Mar 26 2026 Sharanakumar - 2.1.0-1 -- Update to qatengine v2.1.0 - -* Sat Jan 17 2026 Fedora Release Engineering - 2.0.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - -* Fri Jul 25 2025 Fedora Release Engineering - 2.0.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - * Tue Jun 10 2025 Nagha Abirami - 2.0.0-1 - Update to qatengine v2.0.0 Only in /var/lib/copr-rpmbuild/results/qatengine/srpm-unpacked/qatengine-2.1.0.tar.gz-extract/QAT_Engine-2.1.0: release