linux-kernel - Re: [PATCH bpf-next v4 2/6] crypto: Add BPF signature algorithm type registration module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ede58147-3bde-4408-9f69-d2d717b4ee40@linux.dev>
Date: Tue, 6 Jan 2026 22:08:06 +0000
From: Vadim Fedorenko <vadim.fedorenko@...ux.dev>
To: Daniel Hodges <git@...ielhodges.dev>, bpf@...r.kernel.org
Cc: Alexei Starovoitov <ast@...nel.org>, Andrii Nakryiko <andrii@...nel.org>,
 Daniel Borkmann <daniel@...earbox.net>, Song Liu <song@...nel.org>,
 Mykyta Yatsenko <yatsenko@...a.com>, Martin KaFai Lau
 <martin.lau@...ux.dev>, Eduard Zingerman <eddyz87@...il.com>,
 Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
 John Fastabend <john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>,
 Stanislav Fomichev <sdf@...ichev.me>, Yonghong Song
 <yonghong.song@...ux.dev>, Herbert Xu <herbert@...dor.apana.org.au>,
 "David S . Miller" <davem@...emloft.net>, linux-crypto@...r.kernel.org,
 linux-kernel@...r.kernel.org, linux-kselftest@...r.kernel.org
Subject: Re: [PATCH bpf-next v4 2/6] crypto: Add BPF signature algorithm type
 registration module

On 05/01/2026 17:37, Daniel Hodges wrote:
> Add a new bpf_crypto_sig module that registers signature verification
> algorithms with the BPF crypto type system. This enables signature
> operations (like ECDSA) to use the unified bpf_crypto_ctx structure
> instead of requiring separate context types.
> 
> The module provides:
> - alloc_tfm/free_tfm for crypto_sig transform lifecycle
> - has_algo to check algorithm availability
> - get_flags for crypto API flags
> 
> This allows ECDSA and other signature verification operations to
> integrate with the existing BPF crypto infrastructure.
> 
> Signed-off-by: Daniel Hodges <git@...ielhodges.dev>

[...]

> +static int bpf_crypto_sig_setkey(void *tfm, const u8 *key, unsigned int keylen)
> +{
> +	return crypto_sig_set_pubkey(tfm, key, keylen);
> +}

That effectively means that signature verification only is provided for
BPF programs? Do we plan to extend API to sign a buffer?

> +
> +static const struct bpf_crypto_type bpf_crypto_sig_type = {
> +	.alloc_tfm	= bpf_crypto_sig_alloc_tfm,
> +	.free_tfm	= bpf_crypto_sig_free_tfm,
> +	.has_algo	= bpf_crypto_sig_has_algo,
> +	.get_flags	= bpf_crypto_sig_get_flags,
> +	.setkey		= bpf_crypto_sig_setkey,
> +	.owner		= THIS_MODULE,
> +	.name		= "sig",
> +};

I think we have to introduce verify() callback here.