Has anyone been able to use the POWER9 compression and encryption hardware acceleration with SSH?

Unfortunately scp seems to always have poor performance, I was hoping it could be faster with the hardware acceleration. I understand that may have to be setup on both client and server, so let's assume they are both AIX with access to HW acceleration.

The only reference I have found is an undocumented sshd_config "EnableHWCompression" parameter buried in the release notes of OpenSSH 9 on the MRS site.

https://www.ibm.com/resources/mrs/assets/DirectDownload?source=aixbp&lang=en_US#lang=en_US

(fixed link)

This version includes other fixes part of previous fileset release:
-------------------------------------------------------------------------------------------------------
Fix for APAR Draft 17902: sshd may corrupt SYSENVIRON and affect at jobs
Fix for APAR IJ40247: sshd memory leak and core when multiplexing/connection sharing
Fix for Apar Draft 17855 : ssh public key authentication fails if no password defined
Fix for APAR IJ38179 : sshd won't work in Trusted Aix environment.
Fix for CVE-2021-41617 : privilege escalation when AuthorizedKeysCommand/AuthorizedPrincipalsCommand are configured
Fix for APAR IJ32806 : A PIPED COMMAND TO SSH COULD RETURN EAGAIN.
Fix for APAR IJ33264 : OPENSSH 8.X DOES NOT SET PAG VALUE
Introducing new configuration option fipsforopenssh which enforces the following configuration:
  - PubkeyAcceptedKeyTypes rsa-sha2-256,rsa-sha2-512,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384
  - Ciphers aes128-ctr,aes256-ctr,aes128-cbc,aes256-cbc,aes128-gcm@openssh.com,aes256-gcm@openssh.com
  - MACs hmac-sha1,hmac-sha2-256,hmac-sha2-512
  - KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
  - DRBG uses aes256-ctr as the default
Addition of a new configuration option EnableHwCompression to make use of Hardware compression feature in Power9 and above

It makes no mention of encryption. Given the single threaded nature of scp, I think both encryption and compression acceleration would be helpful.

------------------------------
========================
Russell Adams
https://adamssystems.nl/
========================
------------------------------

There's a little more information in these blog posts:

Performance improvement in openssh with on-chip data compression accelerator in power9 
https://community.ibm.com/community/user/power/blogs/swetha-narayana/2021/07/27/performance-improvement-in-openssh-with-on-chip-da

GZIP Acceleration with AIX on Power Systems 
https://community.ibm.com/community/user/power/blogs/brian-veale1/2022/03/14/gzip-acceleration-with-aix-on-power-systems

Hello Russel,

we have tested a lot with ssh / scp and compression.
Result in short was the following:
on a fast connection between the lpars you want to transfer file, the transfer rate with scp drops to 80 MB/s. Without compression and using the option "Ciphers aes256-gcm@openssh.com" in the ssh_config we have a transferrate of 300 MB/s.
Our hardware is a Power1080 with a 100GB adapter.
With a slower network connections compression could increase the transferrate, but it depends on the file.

kind regards,
Joerg

------------------------------
Joerg Kauke
Unix Administrator
COOP Switzerland
------------------------------

Hello

Can you try with the latest OpenSSH 9.2.112.2400 version provided in web download pack: https://www.ibm.com/resources/mrs/assets?source=aixbp&S_PKG=openssh

It has a prereq for OpenSSL 1.1.2.2400 version available at : https://www.ibm.com/resources/mrs/assets?source=aixbp&S_PKG=openssl

In 9.2 openssh version, community has changed the default cipher to chacha20-poly1305 algorithm. This algorithm does not use the Power in-core accelerator. So, from 9.2.112.2400 version, the default Cipher is changed to aes128-ctr which should improve the performance for scp transfer.

Thanks

Regards

Sandeep Umesh

AIX Opensource Security

------------------------------
Sandeep Umesh
------------------------------

ok, then it is not required to update openssl fileset, however we recommend to update to latest openssl 3 available in web pack: https://www.ibm.com/resources/mrs/assets?source=aixbp&S_PKG=openssl

We have now introduced multiple methods to check the integrity of packages provided through MRS site.

You can refer to the Readme file provided along with package which gives details about checking the integrity.

Thanks

Regards

Sandeep Umesh

AIX Opensource Security

Hello Sandeep,

just tested the new versions of openssl and openssh...

Now scp with compression is faster then with the old version, but still not that fast as without compression:

#:~:scp -C /tmp/test.large.file svrsinst1-0:/tmp/test.large.file-1
test.large.file                                                                                                            100% 2048MB 179.4MB/s   00:11
#:~:scp /tmp/test.large.file svrsinst1-0:/tmp/test.large.file-1
test.large.file                                                                                                            100% 2048MB 342.4MB/s   00:05

Hi Joerg, I'm sure you've checked this already, but I'm just wondering if your LPAR is running in POWER9 or POWER9_base mode? What does the nxstat command command return?

For example:

# nxstat -S
nx_accel_mask = 1

GZIP accelerator available

#:~:scp -C /tmp/test.large.file svrsinst1-0:/tmp/test.large.file-1test.large.file                                                                                                            100% 2048MB 179.4MB/s   00:11#:~:scp /tmp/test.large.file svrsinst1-0:/tmp/test.large.file-1test.large.file                                                                                                            100% 2048MB 342.4MB/s   00:05