9 ms·
PfSense 2.5 and AES-NI
- givemefive 9y agoSounds like a move to sell more hardware. My pfsense barely does any crypto. This will push me over to openbsd.
- dom0 9y agoIndeed, AES-NI is very rare. Few computers if any have it. Edit: /s ... ?!
- throwa38282 9y agoI might be mistaken, but I thought it was in every non pentium/celeron/atom chip after 2010 and every chip after 2015 with some extensions. My desktop and laptop have them and they're mid-high end but not upper high end.
- paws 9y agoWhy do you say that? According to [1], AES-NI is not that rare. [1] https://en.wikipedia.org/wiki/AES_instruction_set https://en.wikipedia.org/wiki/AES_instruction_set
- gonzo 9y agoFor Intel CPUs (that are found on ARK): With AES-NI: http://ark.intel.com/Search/FeatureFilter?productType=processors&AESTech=true http://ark.intel.com/Search/FeatureFilter?productType=proces... Without: http://ark.intel.com/Search/FeatureFilter?productType=processors&AESTech=false http://ark.intel.com/Search/FeatureFilter?productType=proces...
- kbenson 9y ago> Edit: /s ... ?! Why are you surprised? If you are trying to make a point that AES-NI is common, just say so. Trying to do so by saying the opposite and expecting people will pick up on the sarcasm through a pure text medium without necessarily sharing the same knowledge to know whether that statement is true or not just adds confusion to the conversation. The point itself is useful, but the manner in which you expressed it emphasizes the delivery over the content, to the degree the content is sometimes obscured.
- gonzo 9y agoIf this was a move to sell more hardware, why wouldn't we make the decision for 2.4 (which is imminent) rather than 2.5, which is based on FreeBSD 12, when 12.0R isn't even scheduled?
- deleted 9y ago[deleted]
- givemefive 9y agoI don't know. What is your reasoning? I don't really understand why you'd want to force people to upgrade HW when they don't need to.
- tptacek 9y agoThere is a difference between a design decision reasonable people can disagree, even forcefully, about, and a design decision that is actually a deceptive attempt to get people to buy new hardware.
- deleted 9y ago[deleted]
- acdha 9y agoThey spelled out the reasoning in the post: “in order to support the increased cryptographic loads that we see as part of pfSense verison 2.5, pfSense Community Edition version 2.5 will include a requirement that the CPU supports AES-NI” You may disagree with that but it's intellectually dishonest to argue as if they didn't provide clear, technically defensible rationale, especially at a time when much of the industry has been moving to hardware offload.
- deleted 9y ago[deleted]
- SaltySolomon 9y agoWait, your argument is that isn't a way to sell more hardware is that you will do it later, not now?
- deprave 9y agoIf I had to guess, I'd say Netgate is working on an SD-WAN service of sorts. Many players in this market are displacing the edge firewall, and offering a built-in service of their own or in partnership with a third-party might be a smart move.
- gonzo 9y agoWhat if we just added and SD-WAN implementation to pfSense?
- deprave 9y agoI see pfSense playing two possible roles the SD-WAN. The first is customer-centric, and will allow pfSense edge devices to connect to a third-party SD-WAN service or one provided by Netgate itself. The other is vendor-centric, and will allow SD-WAN vendors to use pfSense for their Point-of-Presence software when building the geographically distributed network for SD-WAN traffic optimization. Both are smart strategies and well within your core competency. As long as you're not building your own SD-WAN service you're golden.
- gonzo 9y ago> As long as you're not building your own SD-WAN service you're golden. Thanks! Running our own SD-WAN service seems a lot like opening a cute little coffee shop: A fine way to spend a lot of money with no result. There is a third option, which is also customer-centric: Allow the customer to run their own SD-WAN.
- paws 9y agoTL, DR: If you are building a pfSense box with an x86 chip made in the past ~7 years [1], stop reading and carry on. Those of you on a power budget, and want e.g. VPN support at closer to wire speeds, you're being advised to select a CPU with AES-NI to get hardware crypto offload. It's great we have software crypto in the first place, but under load it's likely to put a cap on your max throughput. Kudos to pfSense/Netgate announcing this ahead of time. [1] https://en.wikipedia.org/wiki/AES_instruction_set#Supporting_x86_CPUs https://en.wikipedia.org/wiki/AES_instruction_set#Supporting...
- niftich 9y agoAMD has shipped AES-NI in every processor family starting with Bulldozer in 2011. Intel started in 2010 with Westmere, but kept it out of the lower-end models like Pentium, Celeron, and i3 for several generations. Only since Skylake (2015) is it included in every model produced from a supporting architecture. At least for Intel processors, the generalization above, absent other disclaimers, does not apply. Actual lookup tables are linked in other posts like this one [1]. [1] https://news.ycombinator.com/item?id=14240007 https://news.ycombinator.com/item?id=14240007
- paulmd 9y agoNot Bobcat, unfortunately - which is what's in the PC Engines APUv1.
- kop316 9y agoThe immediate predecessor to the Netgate SG-2220 ( I forget the Model, but it was based off of the the PC Engines apu1d [1]) does not support AES-NI. It has the AMD G series T40E, which is based off of the Bobcat architecture [2] [3]). I use pfsense as a home router, and while I am very happy with it, I will be forced to upgrade that hardware, and I do not use any feature sets that require the use of AES-NI. In addition, the Netgate SG-2220 uses an Atom C2338, which was susceptible to the LPC bus failure [4] [5]. So as of right now, I would also be extremely hesitant to purchase the Netgate SG-2220 without some sort of assurance that the router I got is not affected by it. [1] https://pcengines.ch/apu1d4.htm https://pcengines.ch/apu1d4.htm [2] https://en.wikipedia.org/wiki/List_of_AMD_accelerated_processing_unit_microprocessors https://en.wikipedia.org/wiki/List_of_AMD_accelerated_proces... [3] https://en.wikipedia.org/wiki/Bobcat_(microarchitecture) https://en.wikipedia.org/wiki/Bobcat_(microarchitecture) [4] https://www.netgate.com/products/sg-2220.html https://www.netgate.com/products/sg-2220.html [5] http://www.anandtech.com/show/11110/semi-critical-intel-atom-c2000-flaw-discovered http://www.anandtech.com/show/11110/semi-critical-intel-atom... EDIT: Interestingly enough, someone from Netgate said that the PC Engines APU is unaffected: https://www.reddit.com/r/PFSENSE/comments/68nd6y/pfsense_25_and_aesni/dgzrsma/ https://www.reddit.com/r/PFSENSE/comments/68nd6y/pfsense_25_... EDIT2: Seems they edited that, the APU1d won't be compatible.
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- mrenouf2 9y agoThis is quite obviously an attempt to cut out the flood of cheap embedded PCs which are ideal for pfSense and steer more sales to their own hardware. Systems such as "The vault" sold by protectli.com are completely adequate for the home network (I am capable of pushing > 100Mbit/s over OpenVPN at ~35% CPU). These run older celeron processors and are dirt cheap. Hints: 1) The post implies this restriction will only be for the community (free) edition. "pfSense Community Edition version 2.5 will include a requirement that the CPU supports AES-NI" 2) There is zero reason to require AES-NI, as running with a software fallback will simply yield lower performance. Taking this option away makes no sense unless you want to encourage those who don't pay for software support to buy your hardware, while those already paying for support are free to use their existing gear.
- feld 9y agoWell, if you care about security AES-NI allegedly prevents a side channel attack.
- wtallis 9y agoAre you referring to timing attacks or something even more subtle?
- tptacek 9y agoTiming, data cache, BTB, you name it: doing software AES exposes you to All The Side Channels, and AES is somewhat notoriously hard to implement safely in software compared to other software-profile ciphers. This is the big selling point for ChaPoly.
- dom0 9y agoMost/all software implementations of AES had various side channels in the past. Considering AES-GCM, as far as I'm aware no software implementation is considered "safe". Some libraries do not support AES-GCM without hardware instructions that make it safe (e.g. libsodium choose that way). This is mainly due to AES relying heavily on substitution boxes, i.e. small arrays that are indexed with secrets, which is easy to implement safely in hardware, but difficult in software that runs on a processor with caches and such.
- deleted 9y ago[deleted]
- sharifm 9y agoThis may be a good time to try a new relative open source product. OPNSense is a fork of PFSense with some philosophical and practical differences. Here are some notes on what and why https://docs.opnsense.org/fork/thefork.html https://docs.opnsense.org/fork/thefork.html
- gonzo 9y agoAre you saying that OPNsense doesn't care about AES side-channel attacks?
- sharifm 9y agoWould you please elaborate.
- htilonom 9y agoOh yes, OPNsense. Those sure are some philosophical and practical differences. Differences as in: - code theft - copyright abuse - attempt to steal pfSense trademark in Europe - toxic project members who publicly attack anyone who dares to point out issues (including assault on all major pfSense developers). - hiding serious vulnerabilities - downplaying serious vulnerabilities Oh yes, that's a very different project. I documented most of it here https://www.reddit.com/r/OPNscam/ https://www.reddit.com/r/OPNscam/
- s0ss 9y agoI think it would be healthy for you to 1) read about what copyright actually is and 2) read about what various licenses permit. There seems to be a disconnect between what is actually occurring and your understanding (and subsequent nerd-rage).
- htilonom 9y agoAwww, brand new account just to remind me OPNsense devs and their minions are watching. Thank you <3
- ktta 9y agoIsn't a linux headless box a great alternative to pfsense for non-commercial use? The problem here seems to be that home users now have to shell out more. If you're going to use OpenVPN and other common software, why not just move to linux side of things? It seems that for home use you wouldn't need any enterprise grade software which I feel is the big advantage of pfSense. Sure pf is great but iptables isn't terrible either. I find that the BSDs are becoming increasingly reluctant to any change that goes against their principles which I sometimes find a tad misplaced.
- stock_toaster 9y ago> I find that the BSDs are becoming increasingly reluctant to > any change that goes against their principles which I > sometimes find a tad misplaced. This seems a bit uncharitable. pfsense is an open source firewall product, made/released by a company that sells support and services. I wouldn't call it "one of the BSDs" any more than I would call say.. Sophos Firewall or Smoothwall as linux distributions. Running a properly configured, headless linux box as a firewall would indeed be a fine choice for those technically capable, similarly so would a FreeBSD or OpenBSD install.
- ktta 9y agoI'm not calling it one of the BSDs, but you still have to consider who's running the show. The FreeBSD part behind pfSense is as important as the Debian beind VyOS (although I'm not suggesting VyOS here). If things are completely same from a management/security perspective, then I'd be wrong but it does make a difference when it comes to management, updates, and compatibility etc. Your definition of technically capable is a bit vague. What can a technically capable user do? It can vary from barely being able to use the cli and minimal understanding of basic networking, to being able to compile/tune the kernel by themselves and write drivers in case they are missing.
- itsoggy 9y agoI look after a pfsense box for a school on a 9 year old E2200 that is obsolete by this. On one hand I cannot complain because the server is 9 years old and lasted well, but on the other hand, why not an option for those just needing a packet filter to bypass this? Am I missing something?
- deleted 9y ago[deleted]
- nalllar 9y agoI was just banned from the pfSense subreddit for arguing about this change. https://i.imgur.com/1051KOl.png https://i.imgur.com/1051KOl.png My comments are visible here: https://i.imgur.com/8oZVSJO.png https://i.imgur.com/8oZVSJO.png Lovely. Due to this behaviour by pfSense employees I no longer want to use pfSense. Had no issues with the software and was considering purchasing their hardware. Not any more. archived view of the thread: https://archive.fo/pBoAY https://archive.fo/pBoAY
- i_mormon_stuff 9y agoI was also banned from the pfsense subreddit for same reason. https://i.imgur.com/NR87PO6.png https://i.imgur.com/NR87PO6.png Their employees are major tripping. I asked them a simple question, why do we need AES-NI hardware crypto if we don't use VPN's or anything that uses AES? And he refused to answer then banned. Honestly I do not want to use it anymore and I shant be recommending it anymore to anyone.
- pfsense-ivork 9y agoNo, you were incredibly rude to use and that's why you were banned. I suggest you share full screenshots if you're going to create drama.
- nalllar 9y agoI shared full screenshots of my own comments, except of the mod mail. Here it is: https://i.imgur.com/FlF8E1Q.png https://i.imgur.com/FlF8E1Q.png You deleted your own posts. This is the archive of some of them: https://archive.fo/pBoAY https://archive.fo/pBoAY I don't have an archive of the deeper posts, but they weren't particularly pleasant.
- pfsense-ivork 9y agoThank you for sharing the mod discussion screenshot.
- Gamblore 9y ago
- Gamblore 9y agoLots of bans going on over at /r/pfsense where users are asking straightforward questions and the staff are just banning them. Read the edits made to the posts there crazy.... Seeming more and more like this is a cash grab thing to get people to upgrade to their hardware.
- pfsense-ivork 9y agoYou were banned because you violated rules. You were incredibly rude and then even threatened us. If that wasn't enough you attempted to start a brand new drama thread. "Cash grab thing" assertion proves we were right to ban you.
- nalllar 9y agoYou've just gone and accused Gamblore of being someone who they aren't. You told me to "Chill for 30 days". Maybe you need to chill instead of damaging your brand by lashing out at people?
- pfsense-ivork 9y agoI think it's you who don't know who Gamblore is.
- nalllar 9y agoGamblore can't be i_mormon_stuff, since i_mormon_stuff also has an account here under the same name and posted in this same thread. Was there a third user you banned?
- pfsense-ivork 9y agoNope, just you and i_mormon_stuff. I still think it's him, but lets see if he ever responds.
- 9y ago
- stumpylog 9y agoI have to say, the way that the pfense team is handling it, and the moderators over on reddit, while I had been considering using it, I think I'll use ubiquiti when I upgrade the network
- nalllar 9y agoThe angry pfSense team member just went through and deleted/removed all the comments involved in the thread he was arguing in.
- stock_toaster 9y agoAfter being a pfsense user for many years, I migrated to ubiquiti edgerouter a year or so ago. It has been great!
- Gamblore 9y agoWhat the fuck are you even going on about?
- dang 9y agoPlease don't be uncivil on HN, regardless of how wrong someone else may be. It breaks the site rules to post this way and we ban accounts that do it. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html We detached this comment from https://news.ycombinator.com/item?id=14242458 https://news.ycombinator.com/item?id=14242458 and marked it off-topic.
- gonzo 9y agoA further attempt at explanation. I'll probably clean this up and write another blog post. https://www.reddit.com/r/PFSENSE/comments/68nd6y/pfsense_25_and_aesni/dh0qi53/ https://www.reddit.com/r/PFSENSE/comments/68nd6y/pfsense_25_...
- ChefDenominator 9y agoThis is a real shame. I am going to have to find a different solution, as it turns out that pfSense is one of those projects that happily moves on without you, and I just can't understand why. My Atom board has been perfect, but there is no hardware upgrade option. I guess I'll have to find another project. And, yes, I used to recommend this project to everyone I know, even donated. Oh, well.