PfSense 2.5 and AES-NI • Hacker News Board

Re: PfSense 2.5 and AES-NI

#21

Post by kop316 » Mon, May 01, 2017, 6:39 PM UTC

niftich wrote: post #14

paws wrote: post #10

TL, DR: If you are building a pfSense box with an x86 chip made in the past ~7 years [1], stop reading and carry on. Those of you on a power budget, and want e.g. VPN support at closer to wire speeds, you're being advised to select a CPU with AES-NI to get hardware crypto offload. It's great we have software crypto in the first place, but under load it's likely to put a cap on your max throughput. Kudos to pfSense/Ne…

AMD has shipped AES-NI in every processor family starting with Bulldozer in 2011. Intel started in 2010 with Westmere, but kept it out of the lower-end models like Pentium, Celeron, and i3 for several generations. Only since Skylake (2015) is it included in every model produced from a supporting architecture. At least for Intel processors, the generalization above, absent other disclaimers, does not apply. Actual loo…

The immediate predecessor to the Netgate SG-2220 ( I forget the Model, but it was based off of the the PC Engines apu1d [1]) does not support AES-NI. It has the AMD G series T40E, which is based off of the Bobcat architecture [2] [3]). I use pfsense as a home router, and while I am very happy with it, I will be forced to upgrade that hardware, and I do not use any feature sets that require the use of AES-NI.

In addition, the Netgate SG-2220 uses an Atom C2338, which was susceptible to the LPC bus failure [4] [5]. So as of right now, I would also be extremely hesitant to purchase the Netgate SG-2220 without some sort of assurance that the router I got is not affected by it.

[1] https://pcengines.ch/apu1d4.htm

[2] https://en.wikipedia.org/wiki/List_of_AMD_accelerated_proces...

[3] https://en.wikipedia.org/wiki/Bobcat_(microarchitecture)

[4] https://www.netgate.com/products/sg-2220.html

[5] http://www.anandtech.com/show/11110/semi-critical-intel-atom...

EDIT: Interestingly enough, someone from Netgate said that the PC Engines APU is unaffected: https://www.reddit.com/r/PFSENSE/comments/68nd6y/pfsense_25_... EDIT2: Seems they edited that, the APU1d won't be compatible.

Re: PfSense 2.5 and AES-NI

#22

Post by SaltySolomon » Mon, May 01, 2017, 6:41 PM UTC

gonzo wrote: post #5

givemefive wrote: post #2

Sounds like a move to sell more hardware. My pfsense barely does any crypto. This will push me over to openbsd.

If this was a move to sell more hardware, why wouldn't we make the decision for 2.4 (which is imminent) rather than 2.5, which is based on FreeBSD 12, when 12.0R isn't even scheduled?

Wait, your argument is that isn't a way to sell more hardware is that you will do it later, not now?

Re: PfSense 2.5 and AES-NI

#23

Post by sharifm » Mon, May 01, 2017, 6:46 PM UTC

This may be a good time to try a new relative open source product. OPNSense is a fork of PFSense with some philosophical and practical differences. Here are some notes on what and why https://docs.opnsense.org/fork/thefork.html

Re: PfSense 2.5 and AES-NI

#24

Post by feld » Mon, May 01, 2017, 6:49 PM UTC

mrenouf2 wrote: post #19

This is quite obviously an attempt to cut out the flood of cheap embedded PCs which are ideal for pfSense and steer more sales to their own hardware. Systems such as "The vault" sold by protectli.com are completely adequate for the home network (I am capable of pushing > 100Mbit/s over OpenVPN at ~35% CPU). These run older celeron processors and are dirt cheap. Hints: 1) The post implies this restriction will only be…

Well, if you care about security AES-NI allegedly prevents a side channel attack.

Re: PfSense 2.5 and AES-NI

#25

Post by wtallis » Mon, May 01, 2017, 6:53 PM UTC

feld wrote: post #24

mrenouf2 wrote: post #19

This is quite obviously an attempt to cut out the flood of cheap embedded PCs which are ideal for pfSense and steer more sales to their own hardware. Systems such as "The vault" sold by protectli.com are completely adequate for the home network (I am capable of pushing > 100Mbit/s over OpenVPN at ~35% CPU). These run older celeron processors and are dirt cheap. Hints: 1) The post implies this restriction will only be…

Well, if you care about security AES-NI allegedly prevents a side channel attack.

Are you referring to timing attacks or something even more subtle?

Re: PfSense 2.5 and AES-NI

#26

Post by feld » Mon, May 01, 2017, 6:53 PM UTC

mankyd wrote: post #17

paws wrote: post #10

TL, DR: If you are building a pfSense box with an x86 chip made in the past ~7 years [1], stop reading and carry on. Those of you on a power budget, and want e.g. VPN support at closer to wire speeds, you're being advised to select a CPU with AES-NI to get hardware crypto offload. It's great we have software crypto in the first place, but under load it's likely to put a cap on your max throughput. Kudos to pfSense/Ne…

Close. Sadly the Celeron I bought that came out in 2011 doesn't support this. https://www.newegg.com/Product/Product.aspx?Item=N82E1681911... Do newer, but still cheap CPU's work with AES-NI?

What is your definition of cheap? Don't rule out ARM based solutions.

Re: PfSense 2.5 and AES-NI

#27

Post by porjo » Mon, May 01, 2017, 6:54 PM UTC

paws wrote: post #10

TL, DR: If you are building a pfSense box with an x86 chip made in the past ~7 years [1], stop reading and carry on. Those of you on a power budget, and want e.g. VPN support at closer to wire speeds, you're being advised to select a CPU with AES-NI to get hardware crypto offload. It's great we have software crypto in the first place, but under load it's likely to put a cap on your max throughput. Kudos to pfSense/Ne…

The Celeron J1900 (released 2013) does not support AES-NI. It's popular in low-powered mini PC devices, many of which come preinstalled with pfSense when purchased from Aliexpress.

Re: PfSense 2.5 and AES-NI

#28

Post by tptacek » Mon, May 01, 2017, 6:55 PM UTC

wtallis wrote: post #25

feld wrote: post #24

Earlier quoted context omitted.

Well, if you care about security AES-NI allegedly prevents a side channel attack.

Are you referring to timing attacks or something even more subtle?

Timing, data cache, BTB, you name it: doing software AES exposes you to All The Side Channels, and AES is somewhat notoriously hard to implement safely in software compared to other software-profile ciphers. This is the big selling point for ChaPoly.

Re: PfSense 2.5 and AES-NI

#29

Post by tptacek » Mon, May 01, 2017, 6:57 PM UTC

givemefive wrote: post #18

gonzo wrote: post #5

Earlier quoted context omitted.

If this was a move to sell more hardware, why wouldn't we make the decision for 2.4 (which is imminent) rather than 2.5, which is based on FreeBSD 12, when 12.0R isn't even scheduled?

I don't know. What is your reasoning? I don't really understand why you'd want to force people to upgrade HW when they don't need to.

There is a difference between a design decision reasonable people can disagree, even forcefully, about, and a design decision that is actually a deceptive attempt to get people to buy new hardware.

Re: PfSense 2.5 and AES-NI

#30

Post by dom0 » Mon, May 01, 2017, 7:03 PM UTC

wtallis wrote: post #25

feld wrote: post #24

Earlier quoted context omitted.

Well, if you care about security AES-NI allegedly prevents a side channel attack.

Are you referring to timing attacks or something even more subtle?

Most/all software implementations of AES had various side channels in the past. Considering AES-GCM, as far as I'm aware no software implementation is considered "safe". Some libraries do not support AES-GCM without hardware instructions that make it safe (e.g. libsodium choose that way).

This is mainly due to AES relying heavily on substitution boxes, i.e. small arrays that are indexed with secrets, which is easy to implement safely in hardware, but difficult in software that runs on a processor with caches and such.