[LU-17138] Avoid poor performing crypto engines for client-side encryption

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.16.0
• Affects Version/s: Lustre 2.16.0
• Labels: encryption patch
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: Sebastien Buisson

Description

Lustre client encryption relies on the llcrypt lib to carry out encryption/decryption. This lib leverages the kernel Crypto API to choose the crypto cipher to use. By default it looks for generic implementations of xts(aes), cts(cbc(aes)) and cbc(aes).

While this is fine most of the time, we might want to avoid using some cipher implementations that register under the generic name. For instance, if a cipher is provided by an external accelerator card, we might want to avoid it and prefer in-CPU engines.