cryptographic subsystems in linux

Michael C Richardson (mcr@sandelman.ottawa.on.ca)

In beginning there was the CryptoAPI 0.0, with plans for an asynchronous upgrade. The 2.6 kernel tree introduced a different interface called cryptoapi (1.0), which lacks an asynchronous interface, and has no clear public key support.

In the BSD world, there is the Open Cryptographic Framework (OCF). It has also been ported to Linux. It has asynchronous support but not support for offloading higher level functions (such as SSL record processing or ESP processing. Meanwhile, in the recently opened OpenSolaris, there is another framework with a different set of properties.

This meeting is to present some work for a unified OCF 2.0 and CryptoAPI 2.0, and get feedback on the proposal. There are some major questions to be asked:

1) does anyone care about packet processing and record support?

2) do we care about devices which live on NIC cards, and can not be used generally?

3) are we enthusiastic, neutral or hostile towards having an API that can be used by hardware vendors to write closed source drivers for their hardware?