First of all you will find all references on these web sites :

Linux Kernel

Kernel 2.6.25 has driver for AES, SHA1 and SHA256 in VIA C7 PadLock out of the box. No need to patch it anymore.

When configuring the kernel with for example :

 $ sudo make menuconfig

Set the following options :

 -*- Cryptographic API
 -*- Hardware Cryptographic devices --->
 <M> Support for VIA PadLock ACE
 <M>     PadLock driver for AES algorithm
 <M>     PadLock driver for SHA1 and SHA256 algorithms

Then compile the kernel in the standard debian way :

 $ sudo make-kpkg clean
 $ sudo fakeroot make-kpkg --revision=custom.1.0 kernel_image
 $ sudo dpkg -i ../kernel-image-2.6.25_custom.1.0_i386.deb
 $ sudo mkinitramfs-kpkg -o /boot/initrd.img-2.6.25_custom.1.0 2.6.25_custom.1.0

And edit Grub to add the line for the initrd, something like that :

 title Debian GNU/Linux, kernel 2.6.25_custom.1.0
 root (hd0,0)
 kernel /boot/vmlinuz-2.6.25_custom.1.0 root=/dev/sda1 ro
 initrd /boot/initrd.img-2.6.25_custom.1.0
 savedefault

You can now reboot.

To activate the PadLock optimizations, if you compiled as modules try :

 modprobe padlock_aes padlock_sha

Or add the modules to "/etc/modules".

Linux RNG Entropy

One of the most important think in cryptography is to ensure efficiency of the RNG source. If fact, all initialization vectors, all keys, all random numbers, all prime values ... are generated using data from the RNG source.

The VIA C7 provides a hardware RNG which can be used to add entropy to Linux random source.

To do that, first load the VIA RNG (and add it in "/dev/modules") :

 $ modprobe via_rng

Install rngd, which checks the randomness of hwrng data (VIA hardware RNG) and forwards them into the kernel's pseudo-RNG.

 $ apt-get install rng-tools

And configure the daemon to use the VIA hardware RNG by default, add in file "/etc/default/rng-tools" :

 RNGDOPTIONS="--hrng=via"

And restart the daemon :

 $ sudo sudo /etc/init.d/rng-tools restart

This should now speedup key generation mechanisms (ssh-keygen, OpenSSL Certificates/Keys generation, PGP keys... ).

OpenSSL

The default OpenSSL version packaged with Debian allows do dynamically load engines. So, we will not build a new OpenSSL package but only the padlock engine.

First install the required development packages :

 $ sudo apt-get install build-essential fakeroot
 $ sudo apt-get build-dep openssl
 $ apt-get source openssl

Then we will patch OpenSSL and compile the engine :

 $ cd openssl-0.9.8c
 $ wget http://www.logix.cz/michal/devel/padlock/openssl098-padlock-shared-move.diff | patch -p1
 $ ./Configure
 $ cd engines
 $ make

And create the shared library :

 $ gcc -shared -o libpadlock.so e_padlock.o -L ../.. -lcrypto

Now copy the engine library to the default library :

 $ sudo cp libpadlock.so /usr/lib/ssl/engines/libpadlock.so

And update OpenSSL configuration (/etc/ssl/openssl.cnf) to add the following lines :

 oid_section		= new_oids
 
 ## New entries after this line
 openssl_conf = openssl_def
 
 [openssl_def]
 engines = openssl_engines
 
 [openssl_engines]
 padlock = padlock_engine
 
 [padlock_engine]
 default_algorithms = ALL

To check if all works perfectly try :

 $ sudo openssl engine padlock
 (padlock) VIA PadLock (no-RNG, ACE)

see this site for benchmarks.

OpenSSH

The problem is that OpenSSH does not use (in the version provided with Etch) by default the OpenSSL engines. So for all cryptographic operations the Padlock engine is not use. The current OpenSSH version is 4.3p2 but the patch for "4.5p1" works perfectly.

First, we will prepare the build environment :

 $ sudo apt-get install build-essential fakeroot
 $ sudo apt-get build-dep openssh
 $ apt-get source openssh
 $ cd openssh-4.3p2
 $ wget http://www.logix.cz/michal/devel/padlock/contrib/openssh-4.5p1-engines.diff | patch -p1
 $ fakeroot debian/rules binary

And then install the debian packages, for example SSH client and server :

 $ dpkg -i openssh-server_4.3p2-9etch2_i386.deb openssh-client_4.3p2-9etch2_i386.deb

Conclusion

OpenSSL and OpenSSH are now configured to use Padlock, but instead if OpenSSL selects by default the Padlock engine, the programs which use the library must explicitly activate the use of engines. So, applications which use OpenSSL to provide cryptographic mechanisms must support OpenSSL engine mechanism. It exists patches for many applications (postfix, courrier-imap ...).

The support concists in explicitly load the available hardware cryptographic engines when initializing OpenSSL. For example :

 /* Init available hardware crypto engines. */
 ENGINE_load_builtin_engines();
 ENGINE_register_all_complete();

And eventually set the "padlock" engine by default :

 /* Init available hardware crypto engines. */
 ENGINE_load_builtin_engines();
 ENGINE_register_all_complete();
 ENGINE_set_default_ciphers(ENGINE_by_id("padlock"));