Skip to content

Add a private key provider to accelerate RSA and ECDSA crypto operations on recent Intel Xeon processors. #15871

@ipuustin

Description

@ipuustin

Title: Add a private key provider to accelerate RSA and ECDSA crypto operations on recent Intel Xeon processors.

Description:

Intel's IPP (Integrated Performance Primitives) crypto library has support for multi-buffer crypto operations. Briefly, multi-buffer cryptography is implemented with AVX-512 instructions using a SIMD (single instruction, multiple data) mechanism. Up to eight RSA or ECDSA operations are gathered together into a buffer and processed with a single instruction, providing potentially improved performance. The AVX-512 instructions are available on recently launched Intel Ice Lake Server processors.

We have an Envoy private key provider in the works which we would like to submit as a PR soon. There are a few opens which we would like to get feedback on:

  1. Testing. The functionality can be tested only on the Xeon processors which support the instruction set. We can test this by adding tests which are only run on processors which have the required AVX512 instructions, or alternatively we can mock the library interface and just simulate running the crypto operations in parallel.
  2. External dependency. One extra external dependency (ipp-crypto library) is added to Envoy build. The library itself is pretty straightforward, but it needed to be slightly patched in order for it to compile against BoringSSL instead of OpenSSL. We are however working with the ipp-crypto library team to get the patches merged upstream.

Relevant Links:

https://en.wikipedia.org/wiki/Integrated_Performance_Primitives
https://software.intel.com/content/www/us/en/develop/tools/oneapi/components/ipp.html

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/tlsdesign proposalNeeds design doc/proposal before implementationstalestalebot believes this issue/PR has not been touched recently

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions