> On Fri, Aug 20, 2010 at 07:03:18PM +0200, Nikos Mavrogiannopoulos wrote:
> > On 08/20/2010 03:56 PM, Ted Ts'o wrote:
> > > On Fri, Aug 20, 2010 at 10:45:43AM +0200, Miloslav Trmač wrote:
> > >> Hello, following is a patchset providing an user-space interface to
> > >> the kernel crypto API. It is based on the older, BSD-compatible,
> > >> implementation, but the user-space interface is different.
> > >
> > > What's the goal of exporting the kernel crypto routines to userspace,
> > > as opposed to just simply doing the crypto in userspace?
> >
> > This was the goal of the original cryptodev OpenBSD API and the
> > subsequent linux port in
http://home.gna.org/cryptodev-linux/. In
> > typical PCs it might even be slower to use such an accelerator in kernel
> > space, but in embedded systems where the hardware version of AES might
> > be 100 times faster than the software it might make sense.
>
> OK, but I hope that in that case, we don't go encouraging applications
> to use the /dev/crypto API directly. I know a number of distributions
> have been standardizing on NSS as the library that all of their
> applications will use, such that by simply configuring libnss
> differently, the crypto can either be done in userspace, or it can be
> done in hardware, either for crypto acceleration purposes or for when
> the key is locked inside hardware can only be used with appropriate
> authentication to encrypt or sign data passed to the hardware device.
