Contents

Configuring crypto engines· 1

About crypto engines· 1

Crypto engine types· 1

Crypto engine processing mechanism·· 1

Enabling the GM-capable hardware crypto engine for GM algorithms· 1

Restrictions: Hardware compatibility with crypto engines· 2

Display and maintenance commands for crypto engines· 4

Configuring crypto engines

About crypto engines

Crypto engines encrypt and decrypt data for service modules.

Crypto engine types

Crypto engines include the following types:

·     Hardware crypto engines—A hardware crypto engine is a coprocessor integrated on a CPU or hardware crypto card. Hardware crypto engines can accelerate encryption/decryption speed, which improves device processing efficiency. You can enable or disable hardware crypto engines globally as needed. By default, hardware crypto engines are enabled.

·     Software crypto engines—A software crypto engine is a set of software encryption algorithms. The device uses software crypto engines to encrypt and decrypt data for service modules. They are always enabled. You cannot enable or disable software crypto engines.

Crypto engine processing mechanism

If you disable hardware crypto engines, the device uses only software crypto engines for data encryption/decryption. If you enable hardware crypto engines, the device preferentially uses hardware crypto engines. If the device does not support hardware crypto engines, or if the hardware crypto engines do not support the required encryption algorithm, the device uses software crypto engines for data encryption/decryption.

Crypto engines provide encryption/decryption services for service modules, for example, the IPsec module. When a service module requires data encryption/decryption, it sends the desired data to a crypto engine. After the crypto engine completes data encryption/decryption, it sends the data back to the service module.

Enabling the GM-capable hardware crypto engine for GM algorithms

About this task

By default, the device uses software crypto engines for data encryption/decryption by GM algorithms, including SM2, SM3, and SM4 algorithms. That is, the system uses its own software algorithms for data encryption/decryption. This consumes system resources and is less efficient. When the device is installed with the GM-capable hardware crypto engine, you can perform this task to enable the hardware crypto engine for a specific GM algorithm. Then, data encryption/decryption by that GM algorithm will not consume system resources, which improves device processing efficiency.

Procedure

1.     Enter system view.

system-view

2.     Enable the GM-capable hardware crypto engine for GM algorithms.

crypto-engine accelerator enable gm-algorithm { sm2 | sm3 | sm4 } *

By default, the GM-capable hardware crypto engine is disabled for GM algorithms.

Restrictions: Hardware compatibility with crypto engines

‌

‌

‌

‌

Display and maintenance commands for crypto engines

Execute display commands in any view and reset commands in user view.

‌