Am Freitag, 11. August 2017, 21:43:15 CEST schrieb Mat Martineau: Hi Mat, > > I also would like to have more of those algorithms exposed to userspace, > and I'd like to make sure the API is a good fit. There was extensive > discussion of AF_ALG akcipher last year. v8 of the patch set updates the > implementation but doesn't address the API concerns that kept the previous > versions from being merged, so we seem to be at just as much of an impasse > as before. During last year's discussion, I think we have concluded (and please correct me if I miss something), that the export of the asymmetric HW implementations to user space should - allow a streaming mode where the user space uses the kernel as an accelerator (maybe user space has another way of storing keys) - allow the private key to be retained in kernel space (or even in hardware only) -- i.e. user space only has a handle to the key for a full asym operation The first part is clearly where AF_ALG fits and keyctl does not. This is provided with the current patch set. As the keyctl API only handles, well, keys, access to the raw ciphers may not be possible through this API. And let us face it, a lot of user space code shall support many different OSes. Thus, if you have a crypto lib in user space who has its own key management (which is a core element of such libraries and thus cannot be put into an architecture-dependent code part), having only the keyctl API on Linux for accelerated asym support may not be helpful. The second part is a keyctl domain. I see in-kernel support for this scenario, but have not yet seen the kernel/user interface nor the user space support. Both options are orthogonal, IMHO. Tadeusz Struck provided a patch to link the kernel crypto API / algif_akcipher with the keys subsystem to allow the second requirement to be implemented in algif_akcipher. That patch is on my desk and I plan to integrate it and even make it generic to allow its use for all different cipher types. I have not yet integrated it to allow a small patch set to be reviewed. If it is the will of the council, I can surely add that code to the initial patch set and resubmit. Ciao Stephan
