[LU-17138] Avoid poor performing crypto engines for client-side encryption

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.16.0
• Affects Version/s: Lustre 2.16.0
• Labels: encryption patch
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: Sebastien Buisson

Description

Lustre client encryption relies on the llcrypt lib to carry out encryption/decryption. This lib leverages the kernel Crypto API to choose the crypto cipher to use. By default it looks for generic implementations of xts(aes), cts(cbc(aes)) and cbc(aes).

While this is fine most of the time, we might want to avoid using some cipher implementations that register under the generic name. For instance, if a cipher is provided by an external accelerator card, we might want to avoid it and prefer in-CPU engines.

Comments

[Peter Jones]

Landed for 2.16

[Gerrit Updater]

"Oleg Drokin <[e-mail]>" merged in patch https://review.whamcloud.com/c/fs/lustre-release/+/52477/
Subject: LU-17138 enc: prefer specific crypto engines
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 056eb9dcc0d5f80451c400342d54037f6de24bd9

[Gerrit Updater]

"Sebastien Buisson <[e-mail]>" uploaded a new patch: https://review.whamcloud.com/c/fs/lustre-release/+/52477
Subject: LU-17138 enc: prefer specific crypto engines
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 314b2281a7fb73fdb4560d5a6746a4781c4a9030