From: Tadeusz Struk <tadeusz.struk@intel.com>
To: Marcel Holtmann <marcel@holtmann.org>,
Stephan Mueller <smueller@chronox.de>
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
linux-crypto@vger.kernel.org,
linux-kernel <linux-kernel@vger.kernel.org>,
linux-api@vger.kernel.org, David Howells <dhowells@redhat.com>,
David Woodhouse <dwmw2@infradead.org>
Subject: Re: [PATCH v2 0/5] crypto: add algif_akcipher user space API
Date: Tue, 27 Oct 2015 08:16:53 -0700 [thread overview]
Message-ID: <562F9565.3090005@intel.com> (raw)
In-Reply-To: <BDD3AC1F-26D5-41D2-863B-CF8C7BF5FFEE@holtmann.org>
Hi Marcel,
On 10/26/2015 09:54 PM, Marcel Holtmann wrote:
> after having discussions with David Howells and David Woodhouse, I don't think we should expose akcipher via AF_ALG at all. I think the akcipher operations for sign/verify/encrypt/decrypt should operate on asymmetric keys in the first place. With akcipher you are pretty much bound to public and private keys and the key is the important part and not the akcipher itself. Especially since we want to support private keys in hardware (like TPM for example).
>
> It seems more appropriate to use keyctl to derive the symmetric session key from your asymmetric key. And then use the symmetric session key id with skcipher via AF_ALG. Especially once symmetric key type has been introduced this seems to be trivial then.
>
> I am not really in favor of having two userspace facing APIs for asymmetric cipher usage. And we need to have an API that is capable to work with hardware keys.
The main use case for algif_akcipher will be to allow a web server, which needs to handle
tens of thousand TLS handshakes per second, to offload the RSA operation to a HW accelerator.
Do you think we can use keyctl for this?
Thanks,
T
next prev parent reply other threads:[~2015-10-27 15:20 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-18 10:44 [PATCH v2 0/5] crypto: add algif_akcipher user space API Stephan Mueller
2015-10-18 10:45 ` [PATCH v2 1/5] MPI: fix off by one in mpi_read_raw_from_sgl Stephan Mueller
2015-10-19 23:25 ` Tadeusz Struk
2015-10-20 14:20 ` Herbert Xu
2015-10-18 10:46 ` [PATCH v2 2/5] crypto: AF_ALG -- add sign/verify API Stephan Mueller
2015-10-18 10:47 ` [PATCH v2 3/5] crypto: AF_ALG -- add setpubkey setsockopt call Stephan Mueller
2015-10-30 8:16 ` Marcel Holtmann
2015-10-30 8:42 ` Stephan Mueller
2015-10-18 10:48 ` [PATCH v2 4/5] crypto: AF_ALG -- add asymmetric cipher interface Stephan Mueller
2015-10-18 10:49 ` [PATCH v2 5/5] crypto: algif_akcipher - enable compilation Stephan Mueller
2015-10-19 1:32 ` [PATCH v2 0/5] crypto: add algif_akcipher user space API Herbert Xu
2015-10-19 7:14 ` Stephan Mueller
2015-10-19 7:27 ` Herbert Xu
2015-10-27 4:54 ` Marcel Holtmann
2015-10-27 9:12 ` Stephan Mueller
2015-10-27 9:19 ` David Woodhouse
2015-10-27 10:50 ` Stephan Mueller
2015-10-27 23:15 ` David Woodhouse
2015-10-27 23:35 ` Stephan Mueller
2015-10-27 23:43 ` David Woodhouse
2015-10-27 23:47 ` Stephan Mueller
2015-10-28 0:37 ` David Woodhouse
2015-10-28 1:18 ` Stephan Mueller
2015-10-28 1:36 ` David Woodhouse
2015-10-28 0:46 ` Marcel Holtmann
2015-10-28 1:29 ` Stephan Mueller
2015-10-28 2:56 ` Marcel Holtmann
2015-10-28 10:12 ` Stephan Mueller
2015-10-27 15:16 ` Tadeusz Struk [this message]
2015-12-14 18:06 ` Tadeusz Struk
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=562F9565.3090005@intel.com \
--to=tadeusz.struk@intel.com \
--cc=dhowells@redhat.com \
--cc=dwmw2@infradead.org \
--cc=herbert@gondor.apana.org.au \
--cc=linux-api@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=smueller@chronox.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).