Agent skill · software engineering · nvidia
doca-sha-offload-engine
Use this skill when wiring the DOCA SHA Offload Engine (an OpenSSL ENGINE) into an existing OpenSSL pipeline to offload one-shot SHA-1, SHA-256, or SHA-512 (EVP_Digest) onto DOCA SHA hardware without rewriting against doca-sha. Covers engine load mechanics (`openssl engine dynamic`, `set_pci_addr` ctrl, `-engine_impl`), the SHA-224 negative test that proves offload engaged, the message-size window where offload beats CPU SHA, and engine-vs-library selection. Trigger even when the user does not say "DOCA SHA Offload Engine" or "OpenSSL ENGINE" — typical implicit phrasings: "speed up openssl SHA on BlueField", "offload SHA without code changes", "is openssl using the accelerator or falling back to software", "prove DOCA SHA actually ran", "openssl dgst hashed but I'm not sure it was offloaded". Refuse and route elsewhere for new SHA pipelines (use doca-sha), MD5 / SHA-3 / SHA-224 / HMAC-SHA offload, incremental hashing via chained `EVP_DigestUpdate`, or OpenSSL PROVIDER authoring.
Why this skill is useful
Adds specific integration patterns and executable configurations for offloading SHA operations to DOCA hardware that are not available in public documentation.
What it needs
Requires doca, libssl-dev, openssl installed locally. About 8k tokens when loaded. Last updated 2026-08-07. 2,816 stars on the source repository.
What this skill does
DOCA SHA Offload Engine Examples “Can I offload SHA in an existing OpenSSL pipeline without rewriting?” — this is in scope. Load the engine; do not start a new doca-sha pipeline here. “How do I prove OpenSSL used DOCA SHA, not CPU SHA?” — use the SHA-224 negative test; do not treat a successful digest as proof of offload. Quick answer (answer from this file) 1. Device gate first. The DOCA SHA engine exists only on BlueField-2; BlueField-3 has no SHA acceleration engine (public DOCA SHA guide), so there is nothing to offload there: say so and stop. 2. Load probe: openssl engine dynamic -pre NOVCHECK:1 -pre SOPATH:<engine .so> -pre LOAD -vvv -t -c. 3. Positive test: openssl dgst -sha256 -engine <engine .so> -engineimpl <file> reports the engine was set. 4. Negative test: an unsupported digest (-sha224) must fail with the engine selected; it must not silently fall back. 5. Performance: compare openssl speed -evp sha256 with and without the engine (add -asyncjobs for parallelism). Report measured numbers only; never quote numbers from memory. Instructions Follow Loading order below. Open the tasks companion for configure / run. Open the capabilities companion for when offload wins and how to verify it. Do not open every companion file. Where to start: This is a tool skill for the OpenSSL ENGINE installed by the doca-sha-offload-engine package under ${DOCADIR}/tools/docashaoffloadengine/ as libdocashaoffloadengine.so, next to its enginereadme.md. It is not a CLI — it is a shared object loaded by an OpenSSL-based application or by openssl itself, that re-routes SHA-1 / SHA-256 / SHA-512 (one-shot only, via the EVPDigest interface) onto the DOCA SHA hardware path. Open the tasks companion and start at configure for the PCIe-address configuration and the OpenSSL prerequisites; jump to run for the “load the engine and prove it actually runs” flow. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills nvidia/doca-sha-offload-engine