Re: [Keyrings] Re: [PATCH 01/04] Add multi-precision-integer maths library

["David Härdeman" <david@2gen.com>]

On Sun, Jan 29, 2006 at 01:29:01PM +0100, Adrian Bunk wrote:
>You are taking the wrong approach.
>
>The _only_ question that matters is:
>Why is it technically impossible to do the same in userspace?
>
>If it's technically possible to do the same in userspace, it must not be 
>done in the kernel.

It may not be impossible, but adding support for dsa key types to the 
in-kernel key management is something like 150 lines of code once the 
dsa crypto-ops are implemented. I think you get a lot of convenience 
for those 150 lines (and yes, I do believe that convenience is also a 
valid argument for adding functionality). Having to protect against all 
attack vectors is much harder in user-space than in kernel-space.

As for the addition of the dsa crypto-ops, you still haven't answered 
the question of how signed modules and/or binaries can be implemented
in userspace...

>That's exactly the reason why e.g. kernel 2.6 does not contain a 
>webserver.

Apples and oranges

Re,
David