[tor-relays] Does Tor work with Intel QAT acceleration

Mailing Lists tor-relays
1

Hi all

I have my first Tor relay up und running. It’s currently installed on a little desktop computer with an Intel i5 9500T CPU. My Internet connection is 10Gb/s symetric. From this bandwidth, I would be able to spend a good part for supporting the Tor network.

With that little machine, it seems that it would max out at somewhere at ~30 MBytes/s. For my definitive Tor relay hardware, I’m currently researching some options, which would be capable of handling Tor traffic at the rate of 200 to 300MBytes. Even it would be used nowadays, but who knows whats coming in the future and I hope this relay would last 5 years ore so.

It looks to me, that with a normal CPU, it’s impossible to reach my goal. But then I encountered, that Intel has the Quick Assist Technoloy (QAT) integrated in some of their products (ie. Atom C3xx8). This QAT can be used with OpenSSL as a hardware accelerator for encryption. There also exist dedicated PCIe cards with QAT (ie. Netgate CPIC-8955).

Searching the Internet, I couldn’t find any information if QAT would be helpful with Tor. But Tor uses the OpenSSL library and this can use the QAT acceleration. Is there anyone who has tried this und can share his expirience?

Thanks in advance
Andreas

1 Like
2

Two suggestions:

1) Run speedtest (https://www.speedtest.net) from behind your firewall and verify your actual bandwidth (or at least get a good approximation <smile>).

2) Check the brand of NIC in your current machine. Intel NICs are reportedly much more efficient than RealTek for handling large number of packets - which is why they are recommended for most firewall machines. Suspect that logic would apply for a Tor Relay as well.

Suspect you also want a CPU with AES-NI support. Check the specs on the web, AES-NI should be called out. "cat /proc/cpuinfo | grep aes" will also tell you if your running some flavor of linux.

Kevin

ps. Dig around on the web for firewall hardware recommendations. I know I've seen some tables on throughput for pfsense, shouldn't be too hard to find and might throw some light on the situation.

pps. Very jealous of your connectivity!

···

On 4/10/2022 2:32 PM, Andreas Bollhalder wrote:

Hi all

I have my first Tor relay up und running. It's currently installed on a little desktop computer with an Intel i5 9500T CPU. My Internet connection is 10Gb/s symetric. From this bandwidth, I would be able to spend a good part for supporting the Tor network.

With that little machine, it seems that it would max out at somewhere at ~30 MBytes/s. For my definitive Tor relay hardware, I'm currently researching some options, which would be capable of handling Tor traffic at the rate of 200 to 300MBytes. Even it would be used nowadays, but who knows whats coming in the future and I hope this relay would last 5 years ore so.

It looks to me, that with a normal CPU, it's impossible to reach my goal. But then I encountered, that Intel has the Quick Assist Technoloy (QAT) integrated in some of their products (ie. Atom C3xx8). This QAT can be used with OpenSSL as a hardware accelerator for encryption. There also exist dedicated PCIe cards with QAT (ie. Netgate CPIC-8955).

Searching the Internet, I couldn't find any information if QAT would be helpful with Tor. But Tor uses the OpenSSL library and this can use the QAT acceleration. Is there anyone who has tried this und can share his expirience?

Thanks in advance
Andreas

_______________________________________________
tor-relays mailing list
tor-relays@lists.torproject.org
tor-relays Info Page

_______________________________________________
tor-relays mailing list
tor-relays@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 Like
3

Hello Kevin

Thanks a lot for your response.

  1. Regarding the speedtest, my firewall is limiting the speed to around 6.5Gbit/s. It’s a fanless device and not capable to let me use the full 10Gbit/s. I host my hardware in my living room and can’t install more powerfull, beacuse it would be too noisy and too big… My wife and kids will kill me :slight_smile:

  2. For the NIC currently in use: it’s an Intel I219-LM (rev 10). Maybe the are better models around. But I don’t believe, they would lower the CPU usage by magnitude(s). But I let me educate if I’m wrong.

  3. The CPU in use has the AES-NI flag set in “/proc/cpuinfo”. So a litte acceleration is already in use.

In the old days when using pfSense on a PC Engines Alix, I was using a mini PCI crypto accelerator card. And it could double or tripple the OpenVPN speed. So it seemed to me, that QAT could do the same for Tor.

Andreas

···

On Monday, April 11, 2022 15:58 CEST, Thoughts thoughts@kevinsthoughts.com wrote:

Two suggestions:

  1. Run speedtest (https://www.speedtest.net) from behind your firewall
    and verify your actual bandwidth (or at least get a good approximation
    ).

  2. Check the brand of NIC in your current machine. Intel NICs are
    reportedly much more efficient than RealTek for handling large number of
    packets - which is why they are recommended for most firewall machines.
    Suspect that logic would apply for a Tor Relay as well.

Suspect you also want a CPU with AES-NI support. Check the specs on the
web, AES-NI should be called out. “cat /proc/cpuinfo | grep aes” will
also tell you if your running some flavor of linux.

Kevin

ps. Dig around on the web for firewall hardware recommendations. I know
I’ve seen some tables on throughput for pfsense, shouldn’t be too hard
to find and might throw some light on the situation.

pps. Very jealous of your connectivity!

On 4/10/2022 2:32 PM, Andreas Bollhalder wrote:

Hi all

I have my first Tor relay up und running. It’s currently installed on
a little desktop computer with an Intel i5 9500T CPU. My Internet
connection is 10Gb/s symetric. From this bandwidth, I would be able to
spend a good part for supporting the Tor network.

With that little machine, it seems that it would max out at somewhere
at ~30 MBytes/s. For my definitive Tor relay hardware, I’m currently
researching some options, which would be capable of handling Tor
traffic at the rate of 200 to 300MBytes. Even it would be used
nowadays, but who knows whats coming in the future and I hope this
relay would last 5 years ore so.

It looks to me, that with a normal CPU, it’s impossible to reach my
goal. But then I encountered, that Intel has the Quick Assist
Technoloy (QAT) integrated in some of their products (ie. Atom C3xx8).
This QAT can be used with OpenSSL as a hardware accelerator for
encryption. There also exist dedicated PCIe cards with QAT (ie.
Netgate CPIC-8955).

Searching the Internet, I couldn’t find any information if QAT would
be helpful with Tor. But Tor uses the OpenSSL library and this can use
the QAT acceleration. Is there anyone who has tried this und can share
his expirience?

Thanks in advance
Andreas

tor-relays mailing list
tor-relays@lists.torproject.org
tor-relays Info Page

tor-relays mailing list
tor-relays@lists.torproject.org
tor-relays Info Page

1 Like
4

Hi Andreas

According to [0] QAT supports:

  • RSA with 2048, 3072, and 4096 bit keys
  • ECDH for the Montgomery Curve X25519 and NIST Prime Curves P-256 and P-384
  • ECDSA for the NIST Prime Curves P-256 and P-384
  • AES-GCM with 128, 192, and 256 bit keys

The tor-spec [1] shows that Tor only uses RSA with 1024 Bit Keys and the ciphersuits only contain AES CBC and no AES GCM ones. I’m not an expert but it looks like it’s not that useful for Tor.

Tor doesn’t scale well with multiple CPU cores but you can run 2 relays per IP to better use your hardware. On Debian / Ubuntu you can use tor-instance-create to create multiple relays on the same host.

[0]: Regards Stefan

···

https://www.intel.com/content/www/us/en/developer/articles/guide/building-software-acceleration-features-in-the-intel-qat-engine-for-openssl.html

[1]:

On 11.04.22 21:13, Andreas Bollhalder wrote:

Hello Kevin

Thanks a lot for your response.

  1. Regarding the speedtest, my firewall is limiting the speed to around 6.5Gbit/s. It’s a fanless device and not capable to let me use the full 10Gbit/s. I host my hardware in my living room and can’t install more powerfull, beacuse it would be too noisy and too big… My wife and kids will kill me :slight_smile:

  2. For the NIC currently in use: it’s an Intel I219-LM (rev 10). Maybe the are better models around. But I don’t believe, they would lower the CPU usage by magnitude(s). But I let me educate if I’m wrong.

  3. The CPU in use has the AES-NI flag set in “/proc/cpuinfo”. So a litte acceleration is already in use.

In the old days when using pfSense on a PC Engines Alix, I was using a mini PCI crypto accelerator card. And it could double or tripple the OpenVPN speed. So it seemed to me, that QAT could do the same for Tor.

Andreas

On Monday, April 11, 2022 15:58 CEST, Thoughts wrote:

https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt
thoughts@kevinsthoughts.com

Two suggestions:

  1. Run speedtest () from behind your firewall and verify your actual bandwidth (or at least get a good approximation ). 2) Check the brand of NIC in your current machine. Intel NICs are reportedly much more efficient than RealTek for handling large number of packets - which is why they are recommended for most firewall machines. Suspect that logic would apply for a Tor Relay as well. Suspect you also want a CPU with AES-NI support. Check the specs on the web, AES-NI should be called out. “cat /proc/cpuinfo | grep aes” will also tell you if your running some flavor of linux. Kevin ps. Dig around on the web for firewall hardware recommendations. I know I’ve seen some tables on throughput for pfsense, shouldn’t be too hard to find and might throw some light on the situation. pps. Very jealous of your connectivity! On 4/10/2022 2:32 PM, Andreas Bollhalder wrote: > Hi all > > I have my first Tor relay up und running. It’s currently installed on > a little desktop computer with an Intel i5 9500T CPU. My Internet > connection is 10Gb/s symetric. From this bandwidth, I would be able to > spend a good part for supporting the Tor network. > > With that little machine, it seems that it would max out at somewhere > at ~30 MBytes/s. For my definitive Tor relay hardware, I’m currently > researching some options, which would be capable of handling Tor > traffic at the rate of 200 to 300MBytes. Even it would be used > nowadays, but who knows whats coming in the future and I hope this > relay would last 5 years ore so. > > It looks to me, that with a normal CPU, it’s impossible to reach my > goal. But then I encountered, that Intel has the Quick Assist > Technoloy (QAT) integrated in some of their products (ie. Atom C3xx8). > This QAT can be used with OpenSSL as a hardware accelerator for > encryption. There also exist dedicated PCIe cards with QAT (ie. > Netgate CPIC-8955). > > Searching the Internet, I couldn’t find any information if QAT would > be helpful with Tor. But Tor uses the OpenSSL library and this can use > the QAT acceleration. Is there anyone who has tried this und can share > his expirience? > > Thanks in advance > Andreas > > _______________________________________________ > tor-relays mailing list > > _______________________________________________ tor-relays mailing list

https://www.speedtest.net

tor-relays@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

tor-relays@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

_______________________________________________
tor-relays mailing list

tor-relays@lists.torproject.orghttps://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 Like
5

Hello Stefan

Wow, that’s very good researched. I still didn’t get that deep into this.

So it really seems, there is no special hardware which helps with Tor beside AES-NI, high CPU clock and a good NIC with good drivers.

Yes, I have two instances running. Would be great, to have IPv6 only Tor instances. But I know that it’s currently not supported…

Greetings
Andreas

Hi Andreas

According to 0 QAT supports:

  • RSA with 2048, 3072, and 4096 bit keys
  • ECDH for the Montgomery Curve X25519 and NIST Prime Curves P-256 and P-384
  • ECDSA for the NIST Prime Curves P-256 and P-384
  • AES-GCM with 128, 192, and 256 bit keys

The tor-spec [1] shows that Tor only uses RSA with 1024 Bit Keys and the ciphersuits only contain AES CBC and no AES GCM ones. I’m not an expert but it looks like it’s not that useful for Tor.

Tor doesn’t scale well with multiple CPU cores but you can run 2 relays per IP to better use your hardware. On Debian / Ubuntu you can use tor-instance-create to create multiple relays on the same host.

···

https://www.intel.com/content/www/us/en/developer/articles/guide/building-software-acceleration-features-in-the-intel-qat-engine-for-openssl.html

[1]:

On 11.04.22 21:13, Andreas Bollhalder wrote:

Hello Kevin

Thanks a lot for your response.

  1. Regarding the speedtest, my firewall is limiting the speed to around 6.5Gbit/s. It’s a fanless device and not capable to let me use the full 10Gbit/s. I host my hardware in my living room and can’t install more powerfull, beacuse it would be too noisy and too big… My wife and kids will kill me :slight_smile:

  2. For the NIC currently in use: it’s an Intel I219-LM (rev 10). Maybe the are better models around. But I don’t believe, they would lower the CPU usage by magnitude(s). But I let me educate if I’m wrong.

  3. The CPU in use has the AES-NI flag set in “/proc/cpuinfo”. So a litte acceleration is already in use.

In the old days when using pfSense on a PC Engines Alix, I was using a mini PCI crypto accelerator card. And it could double or tripple the OpenVPN speed. So it seemed to me, that QAT could do the same for Tor.

Andreas

On Monday, April 11, 2022 15:58 CEST, Thoughts wrote:

https://gitweb.torproject.org/torspec.git/tree/tor-spec.txtthoughts@kevinsthoughts.com

Two suggestions:

  1. Run speedtest () from behind your firewalland verify your actual bandwidth (or at least get a good approximation).2) Check the brand of NIC in your current machine. Intel NICs arereportedly much more efficient than RealTek for handling large number ofpackets - which is why they are recommended for most firewall machines. Suspect that logic would apply for a Tor Relay as well.Suspect you also want a CPU with AES-NI support. Check the specs on theweb, AES-NI should be called out. “cat /proc/cpuinfo | grep aes” willalso tell you if your running some flavor of linux.Kevinps. Dig around on the web for firewall hardware recommendations. I knowI’ve seen some tables on throughput for pfsense, shouldn’t be too hardto find and might throw some light on the situation.pps. Very jealous of your connectivity!On 4/10/2022 2:32 PM, Andreas Bollhalder wrote:> Hi all>> I have my first Tor relay up und running. It’s currently installed on> a little desktop computer with an Intel i5 9500T CPU. My Internet> connection is 10Gb/s symetric. From this bandwidth, I would be able to> spend a good part for supporting the Tor network.>> With that little machine, it seems that it would max out at somewhere> at ~30 MBytes/s. For my definitive Tor relay hardware, I’m currently> researching some options, which would be capable of handling Tor> traffic at the rate of 200 to 300MBytes. Even it would be used> nowadays, but who knows whats coming in the future and I hope this> relay would last 5 years ore so.>> It looks to me, that with a normal CPU, it’s impossible to reach my> goal. But then I encountered, that Intel has the Quick Assist> Technoloy (QAT) integrated in some of their products (ie. Atom C3xx8).> This QAT can be used with OpenSSL as a hardware accelerator for> encryption. There also exist dedicated PCIe cards with QAT (ie.> Netgate CPIC-8955).>> Searching the Internet, I couldn’t find any information if QAT would> be helpful with Tor. But Tor uses the OpenSSL library and this can use> the QAT acceleration. Is there anyone who has tried this und can share> his expirience?>> Thanks in advance> Andreas>> _______________________________________________> tor-relays mailing list> > _______________________________________________tor-relays mailing list

https://www.speedtest.net

tor-relays@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

tor-relays@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

_______________________________________________
tor-relays mailing list

tor-relays@lists.torproject.orghttps://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 Like
6

Hi,

to saturate most of this bandwidth, you perhaps like to run multiple tor instances. Because mostly single core tor is cpu bottleneck.
2x tor per single IPv4 allowed for now.

in current c tor we only got minimal TLS options:

# HardwareAccel HardwareAccel 0|1
# If non-zero, try to use built-in (static) crypto hardware acceleration when
# available. Can not be changed while tor is running. (Default: 0)
HardwareAccel 1
# AccelName AccelName __NAME__
# When using OpenSSL hardware crypto acceleration attempt to load the dynamic
# engine of this name. This must be used for any dynamic hardware engine.
# Names can be verified with the openssl engine command. Can not be changed
# while tor is running.

list em with: openssl engine -vv

# AccelDir AccelDir __DIR__
# Specify this option if using dynamic hardware acceleration and the engine
# implementation library resides somewhere other than the OpenSSL default.
# Can not be changed while tor is running.

Good luck with setting up acceleration if even possible in current versions?

Andreas Bollhalder:

···

Hi all

I have my first Tor relay up und running. It's currently installed on a little desktop computer with an Intel i5 9500T CPU. My Internet connection is 10Gb/s symetric. From this bandwidth, I would be able to spend a good part for supporting the Tor network.

With that little machine, it seems that it would max out at somewhere at ~30 MBytes/s. For my definitive Tor relay hardware, I'm currently researching some options, which would be capable of handling Tor traffic at the rate of 200 to 300MBytes. Even it would be used nowadays, but who knows whats coming in the future and I hope this relay would last 5 years ore so.

It looks to me, that with a normal CPU, it's impossible to reach my goal. But then I encountered, that Intel has the Quick Assist Technoloy (QAT) integrated in some of their products (ie. Atom C3xx8). This QAT can be used with OpenSSL as a hardware accelerator for encryption. There also exist dedicated PCIe cards with QAT (ie. Netgate CPIC-8955).

Searching the Internet, I couldn't find any information if QAT would be helpful with Tor. But Tor uses the OpenSSL library and this can use the QAT acceleration. Is there anyone who has tried this und can share his expirience?

Thanks in advance
Andreas

_______________________________________________
tor-relays mailing list
tor-relays@lists.torproject.org
tor-relays Info Page

7

Yes and no? The limitation only apply tor protocol crypto itself afaik.

The tor does relay-to-relay in-protocol crypto inside an outer TLS channel, which the latter currently using GCM afaik:

http://eweiibe6tdjsdprb4px6rqrzzcsi22m4koia44kc5pcjr7nec2rlxyad.onion/tpo/core/tor/-/blob/main/src/lib/tls/tortls_openssl.c#L415

···

Am 12.04.2022 um 16:23 schrieb Bauruine:

The tor-spec [1] shows that Tor only uses RSA with 1024 Bit Keys and the ciphersuits only contain AES CBC and no AES GCM ones. I'm not an expert but it looks like it's not that useful for Tor.

1 Like