• Revision History
• Overview
• Features
• Insecure Algorithms
• Deprecated Features & Planned Deprecations
• Setup
• Supported Devices
• Limitations
• Environmental Assumptions
• Examples
• Open Issues
• Resolved Issues
• Licensing
• Legal
• Terminology

Intel(R) QuickAssist Technology (Intel(R) QAT) provides hardware acceleration for offloading security, authentication and compression services from the CPU, thus significantly increasing the performance and efficiency of standard platform solutions.

Its services include symmetric encryption and authentication, asymmetric encryption, digital signatures, RSA, DH and ECC, and lossless data compression.

This package provides user space libraries that allow access to Intel(R) QuickAssist devices and expose the Intel(R) QuickAssist APIs and sample codes.

The following services are available in qatlib via the QuickAssist API:

• Symmetric (Bulk) Cryptography
  • Ciphers (AES-ECB, AES-CBC, AES-CTR (no partials support), AES-XTS (no partials support), AES-GCM, AES-CCM (192/256), SM4-ECB, SM4-CBC, SM4-CTR)
  • Message digest/hash (SHA1, SHA2 (224/256/384/512), SHA3 (224/256/384/512) (no partials support), SM3) and authentication (AES-CBC-MAC, AES-XCBC-MAC, AES-CMAC-128)
  • Algorithm chaining (one cipher and one hash in a single operation)
  • Authenticated encryption (CCM-128 (no partials support), GCM (128/192/256) (no partials support), GMAC (no partials support) and ChaCha20-Poly1305)
• KeyGen
  • TLS1.2
  • TLS1.3
  • HKDF
  • MGF1
• Asymmetric (Public Key) Cryptography
  • Modular exponentiation and modular inversion up to 8192 bits
  • Diffie-Hellman (DH) key generation phase 1 and 2 up to 8192 bits
  • RSA key generation, encryption/decryption and digital signature generation/verification up to 8192 bits
  • DSA parameter generation and digital signature generation/verification
  • Elliptic Curve Cryptography: ECDSA, ECDHE, Edwards Montgomery curves
  • Generic point multiply
  • SM2
• Compression
  • Deflate
  • lz4/lz4s
  • Compress and Verify (CnV)
  • Compress and Verify and Recover (CnVnR)
  • End-to-end (E2E) integrity check
  • DC compressBound APIs
  • DC NS (No Session) APIs
• Compression Chaining (Deflate only)
  • Hash then compress
• Wireless Algorithms (supported on QAT GEN 5 devices)
  • Ciphers (SNOW3G-UEA2, ZUC-128, ZUC-256, AES-F8)
  • Message digest/hash (SNOW3G-UIA2, ZUC-128, ZUC-256) and authentication (AES-CMAC-128, AES-CMAC-192, AES-CMAC-256)

This package includes:

• libqat: user space library for QAT devices exposed via the vfio kernel driver
• libusdm: user space library for memory management
• qatmgr: user space daemon for device management
• Sample codes: applications to demo usage of the libs

The following algorithms are considered insecure and are disabled by default.

• AES-ECB
• SHA-1
• SHA2-224
• SHA3-224
• RSA512/1024/1536
• DSA
• Diffie-Helman
• Elliptic Curve Cryptography algorithms with less 256 bits
• SM4-ECB

To enable these algorithms, use the following configuration option:

• --enable-legacy-algorithms

• The following configuration option will be deprecated after 2023:
  • --enable-legacy-lib-names

Please refer to INSTALL for details on installing the library.

• 4xxx (QAT GEN 4 devices)
• 420xx (QAT GEN 5 devices)

Earlier generations of QAT devices (e.g. c62x, dh895xxcc, etc.) are not supported.

• If an error occurs on the host driver (Heartbeat, Uncorrectable error) it will not be communicated to the library.
• For simplicity, only one configuration file is used by qatlib. For guidance on how to use this to allocate resources for processes, please refer to Configuration and Tuning section in QATlib User’s Guide.

The following features are not currently supported:

• Dynamic instances
• Intel® Key Protection Technology (KPT)
• Event driven polling
• More than 16 processes per end point (16 is the maximum)
• accumulateXXHash when combined with autoSelectBestHuffmanTree
• accumulateXXHash in Decompression or Combined sessions
• integrityCrcCheck for Compression direction requests

The following assumptions are made concerning the deployment environment:

• Users within the same processing domain must be trusted, i.e.: on the same host or within the same virtual machine, users must trust each other.
• The library can be used by unprivileged users if those users are included in the 'qat' group.
• DRAM is considered to be inside the trust boundary. The typical memory protection schemes provided by the Intel architecture processor and memory controller, and by the operating system, prevent unauthorized access to these memory regions.
• A QuickAssist kernel driver for the supported device is installed, which has discovered and initialized the device, exposing the VFs. This driver is included in the Linux kernel, see INSTALL for information about which kernel to use.

Example applications that showcase usage of the QAT APIs are included in the package (quickassist/lookaside/access_layer/src/sample_code). Please refer to Intel® QuickAssist Technology API Programmer's Guide.

Known issues relating to the Intel® QAT software are described in this section.

Issue titles follow the pattern:

<Component> [Stepping] -  Description of issue

where: <Component> is one of the following:

• CY - Cryptographic
• DC - Compression
• EP - Endpoint
• GEN - General
• SYM DP - Symmetric Cryptography on Data Plane
• SR-IOV - Single Root I/O Virtualization
• FW - Firmware
• PERF - Performance

[Stepping] is an optional qualifier that identifies if the errata applies to a specific device stepping

Resolved issues relating to the Intel® QAT software are described in this section.

• This product is released under the BSD-3-Clause.

Intel, Intel Atom, and Xeon are trademarks of Intel Corporation in the U.S. and/or other countries.

*Other names and brands may be claimed as the property of others.

Copyright © 2016-2022, Intel Corporation. All rights reserved.