[lkml]   [2020]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH v2] drivers: misc: Add support for nCipher HSM devices
On Thu, Jan 09, 2020 at 09:23:52AM +0000, Kim, David wrote:
> > > A cryptographic accelerator uses key material which is stored on, and managed
> > > by, the host machine. Hardware security modules, such as nCipher’s Solo
> > > products, retain key material (i.e. secrets) within the secure boundary of the
> > > device, and implement various forms of access control to restrict use of that
> > > key material.
> > >
> > > nCipher's product range started, in the early 1990s, as cryptographic
> > > accelerators. The series of hardware security modules served by this driver
> > > still does do cryptography but their main function is the generation, management
> > > and use of keys within a secure boundary.
> > >
> > > The driver doesn't do any cryptography. It provides the link between the
> > > userspace software and the HSM's firmware. Cryptography is done within the HSM's
> > > secure boundary.
> >
> > So this should tie into the correct crypto/key apis that the kernel has
> > and not create a brand new user/kernel api, right?
> >
> > Please work with the crypto kernel developers to get this right, I can't
> > take this until they agree that this code and api is correct.
> Although it is technically possible for us to use the linux crypto APIs, that
> doesn't fit in with how our hardware is meant to be used. Please see the
> explanation below from Ian, one of our architects. If you feel that our driver
> should instead be targeted to drivers/crypto, I can resubmit our patch to the
> crypto list and we'll discuss with the crypto maintainers.

As I said, please submit and get approval from the crypto
developers/maintainers first. I need that before I can accept a
brand-new api for a one-off device that then needs to be supported for
40+ years.


greg k-h

 \ /
  Last update: 2020-01-09 10:37    [W:0.058 / U:0.472 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site