AES-NI support

[lars18th]

Hi,

I need to know if:

1. It's the AES-NI support compiled inside the Win10 OpenSSH client and/or server?
2. If YES, then how to check if it's working?

I really like to use only OpenSSH in my Win10, but with good performance (aka with hardware AES).

Best.

[bagajjal]

@lars18th - We use LibreSSL as our crypto provider. Please file the issue with LibreSSL (https://github.com/libressl-portable/portable)

[lars18th]

Hi @bagajjal ,

Thank you for the response! 😉

In this case (LibreSSL as the backend crypto provider), can you explain how to replace the stock DLL?
I suspect we need to recompile it with AES-NI support enabled (available in the library) until you (Microsoft) will compile it with this support enabled.

Regards.

[lars18th]

Hi @bagajjal ,

Perhaps is a good idea to include LibreSSL Tests in the Windows build:
libressl/portable#356

At time I don't know how to check if the AES-NI support is enabled or not in the sshd.exe.

Can you help me in this area?
Thank you!

[lars18th]

Hi,

Any improvement?

Let me explain the relevance of this topic:

• The AES-NI support is a great improvement, as all recent x86 CPUs support for it. Using it, the performance of the encrypted channel is greatly improved.
• The LibreSSL library has support for AES-NI, so you only need to enable it (and if it's enabled, but not supported by the hardware, then the software implementation is used).
• Include some tool to check the support in both: hardware and library, is essential to confirm the availability of AES-NI support.

So, I hope soon we can use it with Win32-OpenSSH.
Regards.

[NoMoreFood]

@lars18th I'm not overly familiar with the LibreSSL library, but at first glance it does not appear that AES-NI support is available for the Windows build (yet). I see AES-NI assembly files for MacOS and ELF, but that's it.

[illera88]

Any reason to use LibreSSL instead of the Windows Crypto API?

[lars18th]

@lars18th - We use LibreSSL as our crypto provider. Please file the issue with LibreSSL (https://github.com/libressl-portable/portable)

Done: libressl/portable#474

[manojampalam]

@illera88

Any reason to use LibreSSL instead of the Windows Crypto API?

OpenSSH is tightly coupled to LibreSSL/OpenSSL via OpenSSL crypto interface. Its not easy to adapt this interface to Windows CNG.