linux-kernel - Re: [PATCH 01/19] User-space API definition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100903091842.GC28952@gondor.apana.org.au>
Date:	Fri, 3 Sep 2010 17:18:42 +0800
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Miloslav Trmač <mitr@...hat.com>
Cc:	linux-crypto@...r.kernel.org,
	Nikos Mavrogiannopoulos <n.mavrogiannopoulos@...il.com>,
	Neil Horman <nhorman@...hat.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 01/19] User-space API definition

On Fri, Aug 20, 2010 at 10:45:44AM +0200, Miloslav Trmač wrote:
> This patch introduces the new user-space API, <ncr.h>.
> 
> Quick overview:
> 
> * open("/dev/crypto") to get a FD, which acts as a namespace for key and
>   session identifiers.
> 
> * ioctl(NCRIO_KEY_INIT) to allocate a key object; then generate the key
>   material inside the kernel, load a plaintext key, unwrap a key, or
>   derive a key.  Similarly the key material can be copied out of the
>   kernel or wrapped.
> 
> * ioctl(NCRIO_SESSION_INIT) to allocate a crypto session (to encrypt,
>   decrypt, hash, sign, or verify signature), then
>   ioctl(NCRIO_SESSION_UPDATE) to act on chunks of data.  Deallocate the
>   session, and optionally retrieve session results (e.g. hash or
>   signature), using ioctl(NCRIO_SESSION_FINAL).
> 
>   There is also NCRIO_SESSION_ONCE for an one-shot crypto operation
>   using a single user->kernel context switch.
> 
> Full documentation of the interface is in
> Documentation/crypto/userspace.txt .

Thanks for the updated patch-set.  It does indeed fulfil some
of the requirements raised earlier.

However, as far as I can see this still does not address the
extensibility.  For example, say we want add an interface to
allow the xoring of two arbitrary data streams using DMA offload,
this interface would make that quite awkward.

In fact the whole interface is really tailored to the traditional
encryption/hash operations that BSD provided so I think this is not
a good foundation for our user-space API.

I will be looking at this myself so please stay tuned and be ready
to yell if you see that your requirements are not met.

Cheers,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/