# On the Hardware-Software Integration in Cryptographic Accelerators for Industrial IoT
## 4 Experimental Results  
All the experiments were performed on a Virtex UltraScale+ HBM VCU128 FPGA, implementing a soft-core RISC-V processor CVA6 along with the Crypto Tile cryptographic accelerator. The CPU runs at 100 MHz, whilst each accelerator's engine has a different operating frequency: 170 MHz AES, 190 MHz SHA and 260 MHz RNG. The Linux Kernel's version is 5.11 and the userspace system is based on BusyBox v1.33.0. In order to analyze the performance of AES and SHA using OpenSSL, the Kernel's implementation and the Crypto Tile, two applications were developed: the first one using Linux's Crypto API and another one that takes advantage of OpenSSL's libcrypto implementation. The first application was developed using libkcapi [23] v1.3.0, a library that handles all of the communications with the kernel's Crypto API interface. The application opens a file passed as an argument and maps it in memory, then saves the initial timestamp. The crypto operation is internally performed in chunks of 4096 bytes, which is the maximum allowed by the kernel. When the last operation is completed, the timestamp is saved again and the time difference, in milliseconds, is printed. For enhanced precision, the timestamp is retrieved using a special register of the RISC-V processor called _cycle_, which contains the number of clock cycles since bootstrap. Since this application uses Linux's Crypto API, it can be used to test both the kernel's implementation and the Crypto Tile. The kernel will select the highest-priority implementation among the available ones. Since the Crypto Tile implementation has a higher priority than the software-based one, the desired selection can be forced by loading or unloading the Crypto Tile driver. The second application was developed using the OpenSSL library v1.1.1l. The overall approach that has been followed is quite similar to the previous one: the operation is performed on chunks; this time, the size of the chunks can be chosen arbitrarily. To maximize performance, in order to compete with the accelerator, a single chunk, whose size is the entire file, was used. In each experiment, the cryptographic operation was performed 20 times. These repetitions were not obtained by restarting the application each time. Instead, the application itself invokes the operation the required amount of times. This approach reduces all the overheads related, for instance, to the creation or destruction of a process, thus reaching a higher level of accuracy. The graphs plot the mean values thus obtained. To understand the behavior of the algorithms and the hardware in different scenarios, the aforementioned procedure was then repeated with files of increasing size: 512 B, 5 KB, 50 KB, 500 KB and 5 MB. These sizes were chosen according to the reference applications of remote software update in robots and remote industrial sensing. Indeed, 512 B should be the typical message of an industrial sensor measuring temperature or pressure data, while 5 MB should be a credible size of a small UGV firmware. All the sizes in between should fit the messages of the majority of IIoT applications. In Figures 3-5, the orange line represents the time taken by OpenSSL, the gray one--by the software implementation inside the kernel (Crypto/SW), and the blue one is obtained using the hardware accelerator (Crypto/HW). Figure 4: Time required to compute each SHA3 algorithm on increasing file sizes. (**a**) SHA3-224. (**b**) SHA3-256. (**c**) SHA3-384. (**d**) SHA3-512. Figure 3: Time required to compute each SHA algorithm on increasing file sizes. (**a**) SHA-224. (**b**) SHA-256. (**c**) SHA3-384. (**d**) SHA-512. Figures 3-5, which cover all SHA algorithms and two AES modes, ECB and CBC, clearly show that, for files smaller than 50 KB both Crypto/HW and Crypto/SW show the same performance, which is much worse than plain OpenSSL; for large files, the fastest option is Crypto/HW, while Crypto/SW remains slower than OpenSSL in most scenarios.