Linux 7.2 Preparing Intel Key Protection Technology "KPT" For Next-Gen QAT
Going back to the launch of 1st Gen Xeon Scalable processors in 2017 was Intel Key Protection Technology (KPT) promoted and there have been Key Protection Technology references in QuickAssist (QAT) documentation since 2016. Surprisingly we are only now seeing Key Protection Technology references for the upstream Linux QAT driver as Intel engineers prepare for their next-gen "Gen6" QuickAssist hardware support.
Intel Key Protection Technology is for protecting keys by hardware encryption while they are in use, in flight, and at rest. With KPT, encryption keys are not exposed in plain text within host memory.for making QuickAssist hardware offloading more secure. Key Protection Technology has been advertised for years by Intel with their QAT-enabled Xeon Scalable processors but seemingly not supported by their mainline Linux driver.
Queued ahead of the Linux 7.2 kernel is this patch in the crypto subsystem's development tree "cryptodev" for adding KPT support with Intel GEN6 QAT.
This includes plumbing the new sysfs interfaces for interacting with QAT KPT support and other infrastructure work with the QAT accelerator crypto driver for handling the Key Protection Technology. At first I was thinking it was just for new GEN6 only support, but going through the Linux source tree as of writing there are no other hits around Key Protection Technology. Intel's open-source QAT library "QATlib" also notes among its limitations is not supporting KPT:
So it seems that the upstream open-source Intel QAT code is finally catching up with KPT. As it's being implemented for QAT GEN6 devices, presumably there are some fundamental KPT improvements there making it more applicable. Intel last year began adding QAT GEN6 support to the Linux kernel and with time exposing new features from new telemetry to better QAT Zstd support. In any event, with the code now being in the cryptodev branch, look for KPT on QAT GEN6 coming with Linux 7.2.
Intel Key Protection Technology is for protecting keys by hardware encryption while they are in use, in flight, and at rest. With KPT, encryption keys are not exposed in plain text within host memory.for making QuickAssist hardware offloading more secure. Key Protection Technology has been advertised for years by Intel with their QAT-enabled Xeon Scalable processors but seemingly not supported by their mainline Linux driver.
Queued ahead of the Linux 7.2 kernel is this patch in the crypto subsystem's development tree "cryptodev" for adding KPT support with Intel GEN6 QAT.
This includes plumbing the new sysfs interfaces for interacting with QAT KPT support and other infrastructure work with the QAT accelerator crypto driver for handling the Key Protection Technology. At first I was thinking it was just for new GEN6 only support, but going through the Linux source tree as of writing there are no other hits around Key Protection Technology. Intel's open-source QAT library "QATlib" also notes among its limitations is not supporting KPT:
So it seems that the upstream open-source Intel QAT code is finally catching up with KPT. As it's being implemented for QAT GEN6 devices, presumably there are some fundamental KPT improvements there making it more applicable. Intel last year began adding QAT GEN6 support to the Linux kernel and with time exposing new features from new telemetry to better QAT Zstd support. In any event, with the code now being in the cryptodev branch, look for KPT on QAT GEN6 coming with Linux 7.2.