View source for Crypto API (Linux)

{{Short description|Linux kernel interface for cryptography}}
'''Crypto API''' is a [[cryptography]] [[framework (software)|framework]] in the [[Linux kernel]], for various parts of the kernel that deal with cryptography, such as [[IPsec]] and [[dm-crypt]]. It was introduced in kernel version 2.5.45<ref>{{cite web
 | url = https://lwn.net/Articles/13587/
 | title = Kernel development
 | year = 2002 | access-date = 2013-09-29
 | publisher = [[LWN.net]]
}}</ref> and has since expanded to include essentially all popular [[block cipher]]s and [[hash function]]s.

== Userspace interfaces ==
Many platforms that provide hardware acceleration of [[AES encryption]] expose this to programs through an extension of the [[instruction set architecture]] (ISA) of the various chipsets (e.g. [[AES instruction set]] for [[x86]]). With this sort of implementation, any program ([[kernel-mode]] or [[user-space]]) may utilize these features directly.

Some platforms, such as the ARM Kirkwood [[SheevaPlug]] and [[AMD Geode]] processors, however, are not implemented as ISA extensions, and are only accessible through kernel-mode drivers. In order for user-mode applications that utilize encryption, such as [[wolfSSL]], [[OpenSSL]] or [[GnuTLS]], to take advantage of such acceleration, they must interface with the kernel.<ref>{{Cite book |last1=Xiao |first1=Yuan |last2=Li |first2=Mengyuan |last3=Chen |first3=Sanchuan |last4=Zhang |first4=Yinqian |chapter=STACCO: Differentially Analyzing Side-Channel Traces for Detecting SSL/TLS Vulnerabilities in Secure Enclaves |date=2017-10-30 |title=Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security |chapter-url=https://dl.acm.org/doi/10.1145/3133956.3134016 |series=CCS '17 |location=New York, NY, USA |publisher=Association for Computing Machinery |pages=859–874 |doi=10.1145/3133956.3134016 |isbn=978-1-4503-4946-8|arxiv=1707.03473 }}</ref>

; AF_ALG
: A [[netlink]]-based interface that adds an <code>AF_ALG</code> address family;<ref>{{cite web
 |last=Edge
 |first=Jake
 |title=A netlink-based user-space crypto API
 |url=https://lwn.net/Articles/410763/
 |publisher=[[LWN.net]]
 |access-date=29 December 2011
 |date=October 20, 2010
}}</ref> it was merged into version 2.6.38 of the [[Linux kernel mainline]].<ref>[http://kernelnewbies.org/Linux_2_6_38#head-6bd372b9e646453417be976d4ff1f31086429b7a Linux_2_6_38 changes]</ref><ref>
[https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=03c8efc1ffeb6b82a22c1af8dd908af349563314 03c8efc] {{webarchive|url=https://archive.today/20130415101617/http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=03c8efc1ffeb6b82a22c1af8dd908af349563314 |date=2013-04-15 }}
[https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=fe869cdb89c95d060c77eea20204d6c91f233b53 fe869cd] {{webarchive|url=https://archive.today/20130415052116/http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=fe869cdb89c95d060c77eea20204d6c91f233b53 |date=2013-04-15 }}
[https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=8ff590903d5fc7f5a0a988c38267a3d08e6393a2 8ff5909] {{webarchive|url=https://archive.today/20130415061420/http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=8ff590903d5fc7f5a0a988c38267a3d08e6393a2 |date=2013-04-15 }}</ref> There was once a plugin to [[OpenSSL]] to support AF_ALG,<ref>{{cite web
 |author=Markus 
 |title=OpenSSL - AF_ALG 
 |url=http://carnivore.it/2011/04/23/openssl_-_af_alg 
 |access-date=29 December 2011 
 |date=2011-10-22 
 |url-status=dead 
 |archive-url=https://web.archive.org/web/20110928014250/http://carnivore.it/2011/04/23/openssl_-_af_alg 
 |archive-date=28 September 2011 
}}</ref> which has been submitted for merging.<ref>{{cite web
 |author=Markus nepenthesdev at gmail.com
 |title=#2554: Patch: AF_ALG dynamic engine for linux >= 2.6.38
 |url=http://rt.openssl.org/Ticket/Display.html?id=2554&user=guest&pass=guest
 |work=[[OpenSSL]]
 |access-date=29 December 2011
 |date=2011-07-03 <!-- at 21:24:59 -->
 |archive-date=2016-04-09
 |archive-url=https://web.archive.org/web/20160409124238/https://rt.openssl.org/Ticket/Display.html?id=2554&user=guest&pass=guest
 |url-status=dead
 }}</ref> In version 1.1.0, OpenSSL landed another patch for AF_ALG contributed by Intel.<ref>{{cite web
 |author=clucey
 |title= ALG: Add AFALG engine 
 |url=https://github.com/openssl/openssl/commit/7f458a48ff3a231d5841466525d2aacbcd4f6b77#commitcomment-18836199
 |work=[[OpenSSL]]
 |access-date=31 August 2016
 |date=2016-02-17 <!-- 13:38 -->
}}</ref> [[wolfSSL]] can make use of AF_ALG and {{not a typo|cryptodev}}<ref>{{cite web
 |author=Jacob 
 |title=AF_ALG + Cryptodev-linux
 |date=19 December 2018
 |url=https://www.wolfssl.com/af_alg-cryptodev-linux/
 |access-date=10 March 2020
}}</ref> 

; cryptodev
: The [[OpenBSD Cryptographic Framework]] <code>/dev/crypto</code> interface of OpenBSD was ported to Linux,<ref>{{cite web
 |last=Ludvig
 |first=Michal
 |title=CryptoDev for Linux
 |url=http://www.logix.cz/michal/devel/cryptodev/
 |access-date=29 December 2011
}}</ref><ref>{{cite web
 |last        = Mavrogiannopoulos
 |first       = Nikos
 |title       = cryptodev-linux
 |url         = http://home.gna.org/cryptodev-linux/
 |access-date  = 12 January 2012
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20120320070655/http://home.gna.org/cryptodev-linux/
 |archive-date = 20 March 2012
}}</ref><ref>{{cite web
 |last=Edge
 |first=Jake
 |title=An API for user-space access to kernel cryptography
 |url=https://lwn.net/Articles/401548/
 |publisher=[[LWN.net]]
 |access-date=29 December 2011
 |date=August 25, 2010
}}</ref> but never merged.

== See also ==
{{Portal|Free and open-source software|Linux}}

* [[Microsoft CryptoAPI]]

== References ==
{{Reflist|30em}}

{{Linux kernel}}

{{DEFAULTSORT:Crypto Api (Linux)}}
[[Category:Application programming interfaces]]
[[Category:Cryptographic software]]
[[Category:Linux security software]]
[[Category:Linux kernel features]]


{{Crypto-stub}}
{{Linux-stub}}