Re: [PATCH 29/33] bpf: crypto: Use AES-CBC and AES-ECB libraries

[Vadim Fedorenko <vadim.fedorenko@linux.dev>]

cc +bpf

On 07/07/2026 06:34, Eric Biggers wrote:
> BPF crypto was implemented using the lskcipher API, which doesn't seem
> to be going anywhere.  It supports only "arc4", "cbc(aes)", "ecb(aes)",
> and only with unoptimized implementations.
> 
> Library APIs also have been found to be a much better approach, for a
> variety of reasons, including reduced overhead, greater flexibility, and
> having to be explicit about the crypto algorithms that are supported.
> 
> We can safely ignore the theoretical "arc4" support in BPF crypto as
> unused, which leaves "cbc(aes)" and "ecb(aes)".  Why these algorithms
> were chosen, it's unclear.  Regardless, I'll assume that "cbc(aes)" and
> "ecb(aes)" need to continue to be supported for backwards compatibility.

That was done for single use case of decrypting small blocks in TC
layer with "cbc(aes)", with assumption of extending it later.

This change looks great, but it would be great to CC bpf folks just to
be aware of the refactoring.

> 
> There are library APIs for these now, which are much easier to use and
> more efficient.  Reimplement BPF crypto on top of them, greatly
> simplifying the code.  As part of this, the bpf_crypto_type abstraction
> layer is removed, as it's not useful.
> 
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>