netdev - Re: [RFC] STCP: secure-by-default transport (kernel-level, experimental)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260105154530.4e8153be@kernel.org>
Date: Mon, 5 Jan 2026 15:45:30 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: Lauri Jakku <lja@....fi>
Cc: Miguel Ojeda <miguel.ojeda.sandonis@...il.com>,
 rust-for-linux@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [RFC] STCP: secure-by-default transport (kernel-level,
 experimental)

On Mon, 5 Jan 2026 17:38:28 +0200 Lauri Jakku wrote:
> Jakub Kicinski kirjoitti 3.1.2026 klo 1.49:
> > On Mon, 22 Dec 2025 20:13:40 +0200 Lauri Jakku wrote:  
> >> STCP is an experimental, TCP-like transport protocol that integrates
> >> encryption and authentication directly into the transport layer, instead
> >> of layering TLS on top of TCP.
> >>
> >> The motivation is not to replace TCP, TLS, or QUIC for general Internet
> >> traffic, but to explore whether *security-by-default at the transport
> >> layer* can simplify certain classes of systems—particularly embedded,
> >> industrial, and controlled environments—where TLS configuration,
> >> certificate management, and user-space complexity are a significant
> >> operational burden.  
> > We tend to merge transport crypto protocol support upstream if:
> >   - HW integration is needed; or
> >   - some network filesystem/block device needs it.
> > Otherwise user space is a better place for the implementation.  
> 
>   I got Nordic Semiconductor contact, that asked if it is upcoming 
> feature for kernel, the need is there (For modem use).

Please come back once it's actually adopted and deployed somewhere.