Asymmetric Cryptography

The Intel QAT Engine provides hardware acceleration for a comprehensive set of asymmetric cryptographic algorithms. These operations are offloaded to QAT hardware devices for improved performance.

​

RSA

RSA operations support both encryption/decryption and signing/verification with hardware acceleration.

​

Supported Key Sizes

​

Operations

• RSA Public Key Encryption - Encrypt data using public key (qat_rsa_pub_enc)
• RSA Private Key Decryption - Decrypt data using private key (qat_rsa_priv_dec)
• RSA Sign - Create digital signatures (qat_rsa_priv_enc)
• RSA Verify - Verify digital signatures (qat_rsa_pub_dec)

​

Notes

• RSA padding schemes are handled by OpenSSL rather than accelerated
• Supports the same padding schemes as OpenSSL natively
• Key sizes below 2048 bits are disabled by default for security reasons

​

Diffie-Hellman (DH)

Diffie-Hellman key exchange for establishing shared secrets.

​

Supported Key Sizes

​

Operations

• Phase 1: Key Generation (qat_dh_generate_key) - Generate public/private key pair
• Phase 2: Compute Key (qat_dh_compute_key) - Compute shared secret from peer’s public key

​

Digital Signature Algorithm (DSA)

DSA signing and verification operations.

​

Supported Parameters

Where:

• L = length of prime p (modulus)
• N = length of prime q (group order)

​

Operations

• DSA Sign (qat_dsa_do_sign) - Generate R and S signature values
• DSA Verify (qat_dsa_do_verify) - Verify R and S signature values

​

Elliptic Curve Diffie-Hellman (ECDH)

Elliptic curve key exchange supporting multiple curve types.

​

Supported Curves

​

NIST Prime Curves

​

NIST Binary Curves

​

NIST Koblitz Curves

​

Montgomery Curves (ECX)

​

Operations

• ECDH Key Generation (qat_ecdh_generate_key) - Generate EC key pair
• ECDH Compute Key (qat_ecdh_compute_key) - Derive shared secret

​

Notes

• Curves with bit length < 256 are disabled by default
• Requires --enable-qat_insecure_algorithms to enable curves below 256 bits

​

Elliptic Curve Digital Signature Algorithm (ECDSA)

ECDSA signing and verification on elliptic curves.

​

Supported Curves

​

NIST Prime Curves

​

NIST Binary Curves

​

NIST Koblitz Curves

​

Operations

• ECDSA Sign (qat_ecdsa_do_sign) - Generate signature (r, s values)
• ECDSA Verify (qat_ecdsa_do_verify) - Verify signature

​

Notes

• Curves with bit length < 256 are disabled by default
• Requires --enable-qat_insecure_algorithms to enable curves below 256 bits

​

SM2

Chinese National Standard elliptic curve cryptography (experimental).

​

Platform Support

​

Operations

• SM2 Key Exchange - ECDH-style key agreement
• SM2 Sign/Verify - Digital signatures

​

Notes

• Disabled by default as experimental
• Available on QAT 1.8 and later platforms
• Used primarily in Chinese cryptographic standards

​

Software Fallback

All asymmetric operations support automatic fallback to OpenSSL software implementation when:

• QAT hardware is unavailable
• Key/parameter sizes are outside supported range
• Operation fails or times out
• Algorithm is unsupported on the platform

​

Platform Support Matrix

Refer to the algorithm support table for detailed platform-specific availability.