skills.rest
NVIDIA
NVIDIAOFFICIAL
Explore all skills by this author →
WebsiteGitHub

doca-sha-offload-engine

Offload one-shot SHA-1, SHA-256, and SHA-512 hashing from OpenSSL pipelines onto DOCA SHA hardware.

3.2k|370|Updated Feb 25, 2026
Search Tags:#cryptography#engine#OpenSSL#doca#bluefield#hardware acceleration#sha offload
One-click install
npx skills add https://github.com/NVIDIA/skills --skill doca-sha-offload-engine
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: doca-sha-offload-engine
Source: https://github.com/NVIDIA/skills/tree/main/skills/doca-sha-offload-engine
Command: npx skills add https://github.com/NVIDIA/skills --skill doca-sha-offload-engine

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Teams with existing OpenSSL-based pipelines want to accelerate SHA hashing on NVIDIA BlueField DPUs or ConnectX NICs without rewriting their applications against the doca-sha C API, and they need a reliable way to prove the hardware offload actually engaged instead of silently falling back to software SHA.

Core Features & Use Cases

  • Engine Load Mechanics: Guides loading the DOCA SHA Offload Engine via openssl engine dynamic or the programmatic ENGINE_load_dynamic / ENGINE_by_id / ENGINE_ctrl_cmd_string sequence, including PCIe address selection with the set_pci_addr ctrl-cmd.
  • Offload Verification: Teaches the SHA-224 negative test and the -engine_impl flag that prove the engine actually computed the digest rather than OpenSSL falling back to software SHA.
  • Performance Characterization: Walks through openssl speed comparisons with -async_jobs and -multi to find the message-size window where offload beats CPU SHA on the user's actual hardware.
  • Use Case: An operator running openssl dgst -sha256 in a production pipeline on a BlueField host uses this Skill to load the engine, verify offload with the SHA-224 negative test, and benchmark whether their message-size mix benefits before committing to deployment.

Quick Start

Ask your agent to help you load the DOCA SHA Offload Engine into your existing OpenSSL pipeline and verify that SHA-256 digests are actually offloaded to the hardware.

Frequently Asked Questions about doca-sha-offload-engine

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I offload OpenSSL SHA hashing to a BlueField DPU without code changes?▼

Load the DOCA SHA Offload Engine with `openssl engine dynamic -pre SO_PATH:<path> -pre LOAD`, then run digests with `openssl dgst -sha256 -engine <path>`. The engine offloads one-shot SHA-1, SHA-256, and SHA-512 to DOCA SHA hardware without rewriting your application.

How do I verify DOCA SHA offload actually engaged instead of software fallback?▼

Run the SHA-224 negative test: `openssl dgst -sha224 -engine <path> -engine_impl` should fail with an error, proving OpenSSL consulted the engine. The `-engine_impl` flag disables OpenSSL's silent software fallback, so a successful SHA-256 run confirms hardware offload.

Should I use the DOCA SHA Offload Engine or call doca-sha directly?▼

Use the engine for existing OpenSSL pipelines wanting offload with minimal change. Use the doca-sha library directly for new pipelines, fine-grained control, partial-hash tasks, or algorithms the engine does not cover such as incremental hashing.

Which SHA algorithms does the DOCA SHA Offload Engine support?▼

The engine offloads only one-shot SHA-1, SHA-256, and SHA-512 via the EVP_Digest interface. SHA-224, SHA-384, SHA-3, MD5, HMAC-SHA, and true incremental hashing are not offloaded and fall back to OpenSSL's software path.

Does the DOCA SHA Offload Engine work with OpenSSL 3.x?▼

Yes, the engine loads on OpenSSL 3.x through the legacy ENGINE code path, and the shipped tests cover OpenSSL 3.0.2 on Ubuntu 22.04. OpenSSL 3.x deprecates the ENGINE API in favor of PROVIDERs, so plan a long-term migration path.

When is DOCA SHA offload faster than CPU SHA?▼

Offload wins for large messages, especially with `-async_jobs` enabled, while small messages around 10 KB may favor CPU SHA due to round-trip cost. The exact crossover depends on device, firmware, and workload, so measure with `openssl speed` on your own hardware.

Related Skills

Explore More Software Engineering Skills→
NVIDIANVIDIA
14

k8s-network-engineer

Configure and troubleshoot NVIDIA networking deployments on Kubernetes.

Official
Advanced
jm199seojm199seo

canary

Monitor live pages for errors and performance regressions after deploys.

Community
Advanced
facebookfacebook
506

debugging

Diagnose Meta Wearables DAT iOS integration failures in device connection and streaming states.

Official
Intermediate
winsorllcwinsorllc

hash-tools

Calculate MD5, SHA-1, SHA-256, SHA-512, BLAKE2b, and BLAKE2s hashes for files and strings.

Community
Intermediate