Messages in this thread |  | | Date | Thu, 9 Jan 2020 10:36:29 +0100 | From | Greg KH <> | Subject | Re: [PATCH v2] drivers: misc: Add support for nCipher HSM devices |
| |
On Thu, Jan 09, 2020 at 09:23:52AM +0000, Kim, David wrote: > > > A cryptographic accelerator uses key material which is stored on, and managed > > > by, the host machine. Hardware security modules, such as nCipher’s Solo > > > products, retain key material (i.e. secrets) within the secure boundary of the > > > device, and implement various forms of access control to restrict use of that > > > key material. > > > > > > nCipher's product range started, in the early 1990s, as cryptographic > > > accelerators. The series of hardware security modules served by this driver > > > still does do cryptography but their main function is the generation, management > > > and use of keys within a secure boundary. > > > > > > The driver doesn't do any cryptography. It provides the link between the > > > userspace software and the HSM's firmware. Cryptography is done within the HSM's > > > secure boundary. > > > > So this should tie into the correct crypto/key apis that the kernel has > > and not create a brand new user/kernel api, right? > > > > Please work with the crypto kernel developers to get this right, I can't > > take this until they agree that this code and api is correct. > > > Although it is technically possible for us to use the linux crypto APIs, that > doesn't fit in with how our hardware is meant to be used. Please see the > explanation below from Ian, one of our architects. If you feel that our driver > should instead be targeted to drivers/crypto, I can resubmit our patch to the > crypto list and we'll discuss with the crypto maintainers.
As I said, please submit and get approval from the crypto developers/maintainers first. I need that before I can accept a brand-new api for a one-off device that then needs to be supported for 40+ years.
thanks,
greg k-h
|  |