KACC_Crypto Cryptographic Algorithm Optimization

English|简体中文

What's New

• [2026-09-30]: Released KACC_Crypto V1.1.0, which incorporated AES-XTS SVE2 optimization, AES-GCM SVE2 optimization, and RSA multi-buffer optimization.

Project Introduction

KACC_Crypto

KACC_Crypto is an OpenSSL cryptographic algorithm optimization source repository for the Kunpeng 950 processor on the AArch64 platform. It currently contains three categories of optimized code (AES-XTS, AES-GCM, and RSA), source code integration scripts, and functional/performance verification scripts.

This repository does not currently provide a standalone runtime library. The AES-XTS and AES-GCM optimizations are integrated into the target OpenSSL source tree through source code integration. After OpenSSL is recompiled, applications still invoke the corresponding algorithms through the OpenSSL EVP/provider interface. The RSA optimization is currently verified through a standalone benchmark executable for the 8-way multi-buffer private CRT path.

KACC_Crypto is suitable for scenarios such as OpenSSL cryptographic algorithm optimization verification, SVE2 instruction path evaluation, upstream patch development, and performance baseline comparison.

Software Architecture

KACC_Crypto integrates with the OpenSSL source tree by writing the optimized source code, build rules, and distribution logic into the corresponding OpenSSL modules through integration scripts. Figure 1 Software architecture shows the overall architecture.

Figure 1 Software architecture

Table 1 Module functions describes the functions of each module in the software architecture.

Table 1 Module functions

Algorithm Support and Specifications

Table 2 Algorithm support and specifications describes the currently supported algorithms and invocation methods.

Table 2 Algorithm support and specifications

Directory Structure

The project directory hierarchy is described as follows:

├── docs                                      # Project documentation directory
│   ├── LICENSE                               # Document license
│   ├── zh                                    # Chinese documentation directory
│       ├── figures                           # Image resources
│       ├── installation_guide.md             # Installation Guide
│       ├── menu_kacc_crypto.md               # Documentation menu
│       ├── quick_start.md                    # Quick Start
│       ├── release_notes.md                  # Release Notes
│       ├── user_guide.md                     # User Guide
│       └── public_sys-resources              # Icon resources
│   └── en                                    # English documentation directory
│       ├── figures                           # Image resources
│       ├── installation_guide.md             # Installation Guide
│       ├── menu_kacc_crypto.md               # Documentation menu
│       ├── quick_start.md                    # Quick Start
│       ├── release_notes.md                  # Release Notes
│       ├── user_guide.md                     # User Guide
│       └── public_sys-resources              # Icon resources
├── openssl
│   ├── crypto
│   │   ├── aes/asm                           # AES-XTS SVE2 source code and tests
│   │   ├── bn/asm                            # RSA SVE2 x8 assembly kernel
│   │   └── modes                             # AES-GCM SVE2 source code and tests
│   └── test                                  # RSA benchmark source code
├── scripts                                   # OpenSSL source code integration and test scripts
└── README.md                                 # Project description document

Release Notes

Table 3 Version Information describes the current version information.

Table 3 Version information

For detailed version capabilities, precautions, and known issues, see Release Notes.

Environment Setup

Environment Requirements

Before deployment, verify the environment based on Table 4 Environment requirements.

Table 4 Environment requirements

Installing Basic Software

• Take a yum-based distribution as an example.

sudo yum install -y git gcc make perl

• Take an apt-based distribution as an example.

sudo apt-get update
sudo apt-get install -y git gcc make perl

Preparing OpenSSL

git clone https://github.com/openssl/openssl.git -b openssl-3.0
cd openssl
./Configure linux-aarch64
make -j$(nproc)

For environment setup details, source code integration, and post-installation verification, see Installation Guide.

Quick Start

1. Obtain the KACC_Crypto source code.

   git clone https://gitcode.com/weiaq/kacc_crypto.git -b dev
   cd kacc_crypto
   export OPENSSL_DIR=/path/to/openssl

2. Integrate the AES-XTS optimization.

   ./scripts/install_sve2_xts_dispatch.sh "${OPENSSL_DIR}"
   cd "${OPENSSL_DIR}"
   make -j$(nproc)

3. Integrate the AES-GCM optimization.

   cd /path/to/kacc_crypto
   ./scripts/install_sve2_gcm_dispatch.sh "${OPENSSL_DIR}"
   cd "${OPENSSL_DIR}"
   make -j$(nproc)

4. Generate the RSA benchmark executable.

   cd /path/to/kacc_crypto
   OPENSSL_DIR=/path/to/openssl ./scripts/apply_and_test_rsa.sh

5. Perform basic verification.

   cd /path/to/kacc_crypto
   OPENSSL_DIR=/path/to/openssl ./scripts/apply_and_test_xts.sh
   OPENSSL_DIR=/path/to/openssl ./scripts/apply_and_test_gcm.sh
   
   cd /path/to/openssl
   taskset -c 10 test/rsa2048_private_rsaz29_x8_bench 1000 all
   taskset -c 10 test/rsa4096_private_rsaz29_x8_bench 200 all

For details about source code acquisition, OpenSSL build, optimized code integration, and basic verification operations, see Quick Start.

Usage Description

AES-XTS Optimization

The AES-XTS optimization is integrated into the OpenSSL provider AES-XTS dispatch layer. After OpenSSL is recompiled, applications do not need to call new external interfaces and can still use AES-XTS through OpenSSL EVP/provider.

You can use OpenSSL speed to verify the EVP path.

cd /path/to/openssl
./apps/openssl speed -elapsed -seconds 10 -evp aes-128-xts aes-192-xts aes-256-xts

AES-GCM Optimization

The AES-GCM optimization is integrated into the OpenSSL provider AES-GCM large-block update path. By default, blocks of 8,192 bytes or larger enter the SVE2 path, while small packets, tail data, and scenarios that do not meet the capability conditions continue to use the Armv8/NEON path.

You can use OpenSSL speed to verify the EVP path.

cd /path/to/openssl
./apps/openssl speed -elapsed -seconds 10 -evp aes-128-gcm aes-192-gcm aes-256-gcm

RSA

RSA currently verifies the 8-way multi-buffer private CRT path through an independent benchmark. The default script only generates RSA2048 and RSA4096 benchmark executables, and does not automatically run long-duration performance tests.

cd /path/to/openssl
taskset -c 10 test/rsa2048_private_rsaz29_x8_bench 1000 all
taskset -c 10 test/rsa4096_private_rsaz29_x8_bench 200 all

An output containing correctness=PASS indicates that the functional verification has passed. For performance results, focus on blinded_speedup_vs_native_default; when analyzing the pure mathematical kernel, refer to math_speedup_vs_native_no_blind.

Related Documents

License

For the document license, see docs/LICENSE. If the source code license needs to be declared separately, the license file in the repository root directory added later shall prevail.

Contribution Statement

We welcome your contributions to the community. If you have any questions/suggestions or want to provide feedback on feature requirements and bug reports, you can submit issues. For details, see the contribution guideline. You are also welcome to share insights in the Discussions. Thank you for your support.

Acknowledgments

Thank you to everyone in the community for your PRs. We welcome your contributions to Kunpeng KACC_Crypto!