SAFE(4)

💖 SAFE(4) — the SafeNet crypto accelerator, but make it a group chat 💖

okay bestie, sit DOWN, because this is safe(4) from the Kernel Interfaces Manual, and she is that girl. crypto but make it hardware. periodt.

---

✨ NAME ✨

safe — SafeNet crypto accelerator 🎀

---

🌸 SYNOPSIS 🌸

so like, you want this driver in your kernel? iconic. drop these lines in your kernel config file:

device crypto
device cryptodev
device safe

orrrr if you're feeling module-at-boot-time energy, put this in loader.conf(5):

safe_load="YES"

and then there's the sysctl besties, the little knobs you can peek at:

sysctl hw.safe.debug
sysctl hw.safe.dump
sysctl hw.safe.rnginterval
sysctl hw.safe.rngbufsize
sysctl hw.safe.rngmaxalarm

---

💅 DESCRIPTION 💅

The safe driver supports cards containing SafeNet crypto accelerator chips. yes literally, it's giving accelerator core.

The safe driver registers itself to accelerate DES, Triple-DES, AES, MD5-HMAC, SHA1-HMAC, and NULL operations for ipsec(4) and crypto(4). she does it ALL, no cap.

On all models, the driver registers itself to provide random data to the random(4) subsystem. Periodically the driver will poll the hardware RNG and retrieve data for use by the system. and if the driver detects that the hardware RNG is resonating with any local signal? she panics a little and resets the oscillators that generate random data. so dramatic, but fair. 🦋

Three sysctl(8) settings control this whole procedure:

• hw.safe.rnginterval — specifies the time, in seconds, between polling operations
• hw.safe.rngbufsize — specifies the number of 32-bit words to retrieve on each poll
• hw.safe.rngmaxalarm — specifies the threshold for resetting the oscillators

---

🙈 debugging era 🙈

When the driver is compiled with SAFE_DEBUG defined, two sysctl(8) variables are provided for debugging purposes:

• hw.safe.debug — can be set to a non-zero value to enable debugging messages to be sent to the console for each cryptographic operation
• hw.safe.dump — a write-only variable that can be used to force driver state to be sent to the console

Set hw.safe.dump to “ring” to dump the current state of the descriptor ring, to “dma” to dump the hardware DMA registers, or to “int” to dump the hardware interrupt registers. choose your fighter, bestie. 💀

---

👑 HARDWARE 👑

The safe driver supports cards containing any of the following chips:

• SafeNet 1141 — The original chipset. Supports DES, Triple-DES, AES, MD5, and SHA-1 symmetric crypto operations, RNG, public key operations, and full IPsec packet processing. the blueprint, the blueprint, the original main character 🌈
• SafeNet 1741 — A faster version of the 1141. glow up confirmed ✨

---

🫶 SEE ALSO 🫶

crypt(3), crypto(4), intro(4), ipsec(4), random(4), crypto(9)

---

😭 BUGS 😭

Public key support is not implemented.

not me reading this and gasping. it's literally right there in the hardware list and yet… not implemented. we simply do not have it. 🍓

---

mwah 💖 that's the whole page, and yes she came from the Debian crew — this version is dated April 1, 2006, filed under SAFE(4). stan a 2006 icon. byeeee 🧚‍♀️