Re: [PATCH v2] drivers: misc: Add support for nCipher HSM devices

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Jan 09, 2020 at 09:23:52AM +0000, Kim, David wrote:
> > > A cryptographic accelerator uses key material which is stored on, and managed
> > > by, the host machine. Hardware security modules, such as nCipher’s Solo
> > > products, retain key material (i.e. secrets) within the secure boundary of the
> > > device, and implement various forms of access control to restrict use of that
> > > key material.
> > > 
> > > nCipher's product range started, in the early 1990s, as cryptographic
> > > accelerators.  The series of hardware security modules served by this driver
> > > still does do cryptography but their main function is the generation, management
> > > and use of keys within a secure boundary.
> > > 
> > > The driver doesn't do any cryptography. It provides the link between the
> > > userspace software and the HSM's firmware. Cryptography is done within the HSM's
> > > secure boundary.
> > 
> > So this should tie into the correct crypto/key apis that the kernel has
> > and not create a brand new user/kernel api, right?
> > 
> > Please work with the crypto kernel developers to get this right, I can't
> > take this until they agree that this code and api is correct.
> 
> 
> Although it is technically possible for us to use the linux crypto APIs, that
> doesn't fit in with how our hardware is meant to be used. Please see the
> explanation below from Ian, one of our architects. If you feel that our driver
> should instead be targeted to drivers/crypto, I can resubmit our patch to the
> crypto list and we'll discuss with the crypto maintainers.

As I said, please submit and get approval from the crypto
developers/maintainers first.  I need that before I can accept a
brand-new api for a one-off device that then needs to be supported for
40+ years.

thanks,

greg k-h