News, tips, partners, and perspectives for the Oracle Solaris operating system

New Crypto Hardware

Darren Moffat
Senior Software Architect

Just incase you missed the official press release from Sun at RSA last week we announced the new SCA-6000 crypto key store and accelerator card.

This is going to be a very cool card. It is the natural evolution of
the SCA-4000 card and for many people the key difference will be its support of AES which the SCA-1000 and SCA-4000 did not have. I'm also really pleased that it will be supported both on SPARC and x64 hardware.

My team had some additional crypto framework mini projects to do to help support this new hardware. We have a policy in our group that for any algorithm, keylength and mode that is supported by any Sun shipped hardware we must provide a software provider that does the same. This ensures that in key by value situations, which is true for Kerberized NFS and for IPsec (note that for IKE the key is by reference), we can fallback to software if the hardware is removed or breaks. The changes we added should all be in the second update release for Solaris 10, which ships around about the same time frame as the SCA-6000 hardware is released.

Join the discussion

Comments ( 3 )
  • Derek Morr Wednesday, February 22, 2006
    You probably can't comment on this, but are there any plans to rev the SCA-500? I have one in each of my V240s, and they are sweet little cards -- very fast and they don't even use a PCI slot. Best ~$500 bucks I spent on a server upgrade.
  • Darren J Moffat Wednesday, February 22, 2006

    As far as I know we have no plans to rev the SCA-500 or the SCA-1000. The driver for those cards, dca(7d), will actually drive some Broadcom PCI cards as well. The driver is also available in source code under the CDDL on opensolaris.org.

    For our newest SPARC based servers that fill the same target area that many V240's are used for, particulary ones with an SCA-500 card (SSL web serving) the UltraSPARC T1 (Niagara) machines (T1000 & T2000) will do the crypto much faster, faster even than the new SCA-6000 can achieve. The key value for an SCA-6000 in an UltrSPARC T1
    is the key store; which the SCA-500 and SCA-1000 didn't provide.

  • Derek Morr Wednesday, February 22, 2006
    Yea, I've been eyeing up the T2000. I've had a call into my Sun rep for almost 3 months trying to get an eval unit. Maybe I'll get one soon :)
Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.