imported>VulcanSphere: Adding local short description: "Linux kernel interface for cryptography", overriding Wikidata description "Linux kernel interface for cryptography"

2024-12-24T03:34:47Z

Adding local short description: "Linux kernel interface for cryptography", overriding Wikidata description "Linux kernel interface for cryptography"

New page

{{Short description|Linux kernel interface for cryptography}}
'''Crypto API''' is a [[cryptography]] [[framework (software)|framework]] in the [[Linux kernel]], for various parts of the kernel that deal with cryptography, such as [[IPsec]] and [[dm-crypt]]. It was introduced in kernel version 2.5.45<ref>{{cite web
| url = https://lwn.net/Articles/13587/
| title = Kernel development
| year = 2002 | access-date = 2013-09-29
| publisher = [[LWN.net]]
}}</ref> and has since expanded to include essentially all popular [[block cipher]]s and [[hash function]]s.

== Userspace interfaces ==
Many platforms that provide hardware acceleration of [[AES encryption]] expose this to programs through an extension of the [[instruction set architecture]] (ISA) of the various chipsets (e.g. [[AES instruction set]] for [[x86]]). With this sort of implementation, any program ([[kernel-mode]] or [[user-space]]) may utilize these features directly.

Some platforms, such as the ARM Kirkwood [[SheevaPlug]] and [[AMD Geode]] processors, however, are not implemented as ISA extensions, and are only accessible through kernel-mode drivers. In order for user-mode applications that utilize encryption, such as [[wolfSSL]], [[OpenSSL]] or [[GnuTLS]], to take advantage of such acceleration, they must interface with the kernel.<ref>{{Cite book |last1=Xiao |first1=Yuan |last2=Li |first2=Mengyuan |last3=Chen |first3=Sanchuan |last4=Zhang |first4=Yinqian |chapter=STACCO: Differentially Analyzing Side-Channel Traces for Detecting SSL/TLS Vulnerabilities in Secure Enclaves |date=2017-10-30 |title=Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security |chapter-url=https://dl.acm.org/doi/10.1145/3133956.3134016 |series=CCS '17 |location=New York, NY, USA |publisher=Association for Computing Machinery |pages=859–874 |doi=10.1145/3133956.3134016 |isbn=978-1-4503-4946-8|arxiv=1707.03473 }}</ref>

; AF_ALG
: A [[netlink]]-based interface that adds an <code>AF_ALG</code> address family;<ref>{{cite web
|last=Edge
|first=Jake
|title=A netlink-based user-space crypto API
|url=https://lwn.net/Articles/410763/
|publisher=[[LWN.net]]
|access-date=29 December 2011
|date=October 20, 2010
}}</ref> it was merged into version 2.6.38 of the [[Linux kernel mainline]].<ref>[http://kernelnewbies.org/Linux_2_6_38#head-6bd372b9e646453417be976d4ff1f31086429b7a Linux_2_6_38 changes]</ref><ref>
[https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=03c8efc1ffeb6b82a22c1af8dd908af349563314 03c8efc] {{webarchive|url=https://archive.today/20130415101617/http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=03c8efc1ffeb6b82a22c1af8dd908af349563314 |date=2013-04-15 }}
[https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=fe869cdb89c95d060c77eea20204d6c91f233b53 fe869cd] {{webarchive|url=https://archive.today/20130415052116/http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=fe869cdb89c95d060c77eea20204d6c91f233b53 |date=2013-04-15 }}
[https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=8ff590903d5fc7f5a0a988c38267a3d08e6393a2 8ff5909] {{webarchive|url=https://archive.today/20130415061420/http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=8ff590903d5fc7f5a0a988c38267a3d08e6393a2 |date=2013-04-15 }}</ref> There was once a plugin to [[OpenSSL]] to support AF_ALG,<ref>{{cite web
|author=Markus
|title=OpenSSL - AF_ALG
|url=http://carnivore.it/2011/04/23/openssl_-_af_alg
|access-date=29 December 2011
|date=2011-10-22
|url-status=dead
|archive-url=https://web.archive.org/web/20110928014250/http://carnivore.it/2011/04/23/openssl_-_af_alg
|archive-date=28 September 2011
}}</ref> which has been submitted for merging.<ref>{{cite web
|author=Markus nepenthesdev at gmail.com
|title=#2554: Patch: AF_ALG dynamic engine for linux >= 2.6.38
|url=http://rt.openssl.org/Ticket/Display.html?id=2554&user=guest&pass=guest
|work=[[OpenSSL]]
|access-date=29 December 2011
|date=2011-07-03 
|archive-date=2016-04-09
|archive-url=https://web.archive.org/web/20160409124238/https://rt.openssl.org/Ticket/Display.html?id=2554&user=guest&pass=guest
|url-status=dead
}}</ref> In version 1.1.0, OpenSSL landed another patch for AF_ALG contributed by Intel.<ref>{{cite web
|author=clucey
|title= ALG: Add AFALG engine
|url=https://github.com/openssl/openssl/commit/7f458a48ff3a231d5841466525d2aacbcd4f6b77#commitcomment-18836199
|work=[[OpenSSL]]
|access-date=31 August 2016
|date=2016-02-17 
}}</ref> [[wolfSSL]] can make use of AF_ALG and {{not a typo|cryptodev}}<ref>{{cite web
|author=Jacob
|title=AF_ALG + Cryptodev-linux
|date=19 December 2018
|url=https://www.wolfssl.com/af_alg-cryptodev-linux/
|access-date=10 March 2020
}}</ref>

; cryptodev
: The [[OpenBSD Cryptographic Framework]] <code>/dev/crypto</code> interface of OpenBSD was ported to Linux,<ref>{{cite web
|last=Ludvig
|first=Michal
|title=CryptoDev for Linux
|url=http://www.logix.cz/michal/devel/cryptodev/
|access-date=29 December 2011
}}</ref><ref>{{cite web
|last = Mavrogiannopoulos
|first = Nikos
|title = cryptodev-linux
|url = http://home.gna.org/cryptodev-linux/
|access-date = 12 January 2012
|url-status = dead
|archive-url = https://web.archive.org/web/20120320070655/http://home.gna.org/cryptodev-linux/
|archive-date = 20 March 2012
}}</ref><ref>{{cite web
|last=Edge
|first=Jake
|title=An API for user-space access to kernel cryptography
|url=https://lwn.net/Articles/401548/
|publisher=[[LWN.net]]
|access-date=29 December 2011
|date=August 25, 2010
}}</ref> but never merged.

== See also ==
{{Portal|Free and open-source software|Linux}}

* [[Microsoft CryptoAPI]]

== References ==
{{Reflist|30em}}

{{Linux kernel}}

{{DEFAULTSORT:Crypto Api (Linux)}}
[[Category:Application programming interfaces]]
[[Category:Cryptographic software]]
[[Category:Linux security software]]
[[Category:Linux kernel features]]

{{Crypto-stub}}
{{Linux-stub}}

Crypto API (Linux) - Revision history

imported>VulcanSphere: Adding local short description: "Linux kernel interface for cryptography", overriding Wikidata description "Linux kernel interface for cryptography"