From: Ted Ts'o <tytso@mit.edu>
To: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
Cc: "Miloslav Trmač" <mitr@redhat.com>,
"Herbert Xu" <herbert@gondor.hengli.com.au>,
linux-crypto@vger.kernel.org, "Neil Horman" <nhorman@redhat.com>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH 00/19] RFC, v2: "New" /dev/crypto user-space interface
Date: Fri, 20 Aug 2010 19:48:11 -0400 [thread overview]
Message-ID: <20100820234811.GB10450@thunk.org> (raw)
In-Reply-To: <4C6EB556.3050608@gmail.com>
On Fri, Aug 20, 2010 at 07:03:18PM +0200, Nikos Mavrogiannopoulos wrote:
> On 08/20/2010 03:56 PM, Ted Ts'o wrote:
> > On Fri, Aug 20, 2010 at 10:45:43AM +0200, Miloslav Trmač wrote:
> >> Hello, following is a patchset providing an user-space interface to
> >> the kernel crypto API. It is based on the older, BSD-compatible,
> >> implementation, but the user-space interface is different.
> >
> > What's the goal of exporting the kernel crypto routines to userspace,
> > as opposed to just simply doing the crypto in userspace?
>
> This was the goal of the original cryptodev OpenBSD API and the
> subsequent linux port in http://home.gna.org/cryptodev-linux/. In
> typical PCs it might even be slower to use such an accelerator in kernel
> space, but in embedded systems where the hardware version of AES might
> be 100 times faster than the software it might make sense.
OK, but I hope that in that case, we don't go encouraging applications
to use the /dev/crypto API directly. I know a number of distributions
have been standardizing on NSS as the library that all of their
applications will use, such that by simply configuring libnss
differently, the crypto can either be done in userspace, or it can be
done in hardware, either for crypto acceleration purposes or for when
the key is locked inside hardware can only be used with appropriate
authentication to encrypt or sign data passed to the hardware device.
If you encourage applications to use /dev/crypto directly, then either
(a) they will be much slower on PC's, or (b) the applications will
need to be rewritten when they are moved between your embedded devices
and standard PC's.
- Ted
next prev parent reply other threads:[~2010-08-20 23:48 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-08-20 8:45 [PATCH 00/19] RFC, v2: "New" /dev/crypto user-space interface Miloslav Trmač
2010-08-20 8:45 ` [PATCH 01/19] User-space API definition Miloslav Trmač
2010-08-20 12:48 ` Stefan Richter
2010-08-21 7:35 ` Nikos Mavrogiannopoulos
2010-08-21 9:11 ` Miloslav Trmac
2010-08-20 17:12 ` Randy Dunlap
2010-08-21 13:09 ` Kyle Moffett
2010-08-21 14:54 ` Nikos Mavrogiannopoulos
2010-08-22 10:22 ` David Howells
2010-09-03 9:18 ` Herbert Xu
2010-09-03 9:18 ` Herbert Xu
2010-09-03 9:34 ` Nikos Mavrogiannopoulos
2010-09-03 9:34 ` Nikos Mavrogiannopoulos
2010-09-03 15:20 ` Nikos Mavrogiannopoulos
2010-09-03 15:20 ` Nikos Mavrogiannopoulos
2010-08-20 8:45 ` [PATCH 02/19] Add CRYPTO_USERSPACE config option Miloslav Trmač
2010-08-20 8:45 ` [PATCH 03/19] Add libtommath headers Miloslav Trmač
2010-08-20 8:45 ` [PATCH 04/19] Add libtomcrypt headers Miloslav Trmač
2010-08-20 8:45 ` [PATCH 05/19] Add internal /dev/crypto implementation headers Miloslav Trmač
2010-08-20 8:45 ` [PATCH 06/19] Add ioctl() argument and attribute handling utils Miloslav Trmač
2010-08-20 12:59 ` Stefan Richter
2010-08-21 2:15 ` Miloslav Trmac
2010-08-21 7:15 ` Stefan Richter
2010-08-20 8:45 ` [PATCH 07/19] Add crypto API utilities Miloslav Trmač
2010-08-20 8:45 ` [PATCH 08/19] Add per-process and per-user limits Miloslav Trmač
2010-08-20 8:45 ` [PATCH 09/19] Add libtommath implementation Miloslav Trmač
2010-08-20 8:45 ` [PATCH 10/19] Add libtomcrypt implementation Miloslav Trmač
2010-08-20 8:45 ` [PATCH 10/19] Add libtommath implementation Miloslav Trmač
2010-08-20 8:45 ` [PATCH 11/19] Add algorithm properties table Miloslav Trmač
2010-08-20 8:45 ` [PATCH 12/19] Add DH implementation and pubkey abstraction layer Miloslav Trmač
2010-08-20 8:45 ` [PATCH 13/19] Add /dev/crypto auditing infrastructure Miloslav Trmač
2010-08-20 8:45 ` [PATCH 14/19] Add most operations on key objects Miloslav Trmač
2010-08-20 8:45 ` [PATCH 15/19] Add key wrapping operations Miloslav Trmač
2010-08-20 8:46 ` [PATCH 16/19] Add helpers for zero-copy userspace access Miloslav Trmač
2010-08-20 8:46 ` [PATCH 17/19] Add session operations Miloslav Trmač
2010-08-20 8:46 ` [PATCH 18/19] Add ioctl handlers Miloslav Trmač
2010-08-20 8:46 ` [PATCH 19/19] Finally, add the /dev/crypto device Miloslav Trmač
2010-08-20 13:56 ` [PATCH 00/19] RFC, v2: "New" /dev/crypto user-space interface Ted Ts'o
2010-08-20 17:03 ` Nikos Mavrogiannopoulos
2010-08-20 17:03 ` Nikos Mavrogiannopoulos
2010-08-20 23:48 ` Ted Ts'o [this message]
2010-08-23 6:39 ` Tomas Mraz
2010-08-21 17:08 ` Arnd Bergmann
2010-08-22 7:52 ` Nikos Mavrogiannopoulos
2010-08-23 8:09 ` Arnd Bergmann
2010-08-23 9:34 ` Nikos Mavrogiannopoulos
2010-08-25 6:20 ` Pavel Machek
2010-08-25 6:44 ` Tomas Mraz
2010-08-25 15:28 ` Miloslav Trmac
[not found] <1291324238.1127211282578687312.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com>
2010-08-23 16:03 ` Miloslav Trmac
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100820234811.GB10450@thunk.org \
--to=tytso@mit.edu \
--cc=herbert@gondor.hengli.com.au \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mitr@redhat.com \
--cc=n.mavrogiannopoulos@gmail.com \
--cc=nhorman@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.