-
Notifications
You must be signed in to change notification settings - Fork 5.3k
Description
Title: Add a private key provider to accelerate RSA and ECDSA crypto operations on recent Intel Xeon processors.
Description:
Intel's IPP (Integrated Performance Primitives) crypto library has support for multi-buffer crypto operations. Briefly, multi-buffer cryptography is implemented with AVX-512 instructions using a SIMD (single instruction, multiple data) mechanism. Up to eight RSA or ECDSA operations are gathered together into a buffer and processed with a single instruction, providing potentially improved performance. The AVX-512 instructions are available on recently launched Intel Ice Lake Server processors.
We have an Envoy private key provider in the works which we would like to submit as a PR soon. There are a few opens which we would like to get feedback on:
- Testing. The functionality can be tested only on the Xeon processors which support the instruction set. We can test this by adding tests which are only run on processors which have the required AVX512 instructions, or alternatively we can mock the library interface and just simulate running the crypto operations in parallel.
- External dependency. One extra external dependency (ipp-crypto library) is added to Envoy build. The library itself is pretty straightforward, but it needed to be slightly patched in order for it to compile against BoringSSL instead of OpenSSL. We are however working with the ipp-crypto library team to get the patches merged upstream.
Relevant Links:
https://en.wikipedia.org/wiki/Integrated_Performance_Primitives
https://software.intel.com/content/www/us/en/develop/tools/oneapi/components/ipp.html