Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933182AbcDLLN3 (ORCPT ); Tue, 12 Apr 2016 07:13:29 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37297 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932307AbcDLLN1 (ORCPT ); Tue, 12 Apr 2016 07:13:27 -0400 Subject: Re: [PATCH 0/3] crypto: af_alg - add TLS type encryption References: <20160306012044.6369.63924.stgit@tstruk-mobl1> <20160405112940.GB11852@gondor.apana.org.au> <57054DBC.8010507@intel.com> <20160408025250.GA7596@gondor.apana.org.au> Cc: Tom Herbert , Herbert Xu , linux-crypto@vger.kernel.org, LKML , "David S. Miller" , Linux Kernel Network Developers , davejwatson@fb.com, nmav@gnutls.org, fridolin.pokorny@gmail.com From: Fridolin Pokorny X-Enigmail-Draft-Status: N1110 To: Tadeusz Struk Message-ID: <570CD852.7060003@redhat.com> Date: Tue, 12 Apr 2016 13:13:22 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 12 Apr 2016 11:13:27 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1102 Lines: 31 On 08.04.2016 04:58, Tom Herbert wrote: > On Thu, Apr 7, 2016 at 11:52 PM, Herbert Xu wrote: >> On Wed, Apr 06, 2016 at 10:56:12AM -0700, Tadeusz Struk wrote: >>> >>> The intend is to enable HW acceleration of the TLS protocol. >>> The way it will work is that the user space will send a packet of data >>> via AF_ALG and HW will authenticate and encrypt it in one go. >> >> There have been suggestions to implement TLS data-path within >> the kernel. So we should decide whether we pursue that or go >> with your approach before we start adding algorithms. >> > Yes, please see Dave Watson's patches on this. > Hi Tadeusz, we were experimenting with this. We have a prove of concept of a kernel TLS type socket, so called AF_KTLS, which is based on Dave Watson's RFC5288 patch. It handles both TLS and DTLS, unfortunately it is not ready now to be proposed here. There are still issues which should be solved (but mostly user space API design) [1]. If you are interested, we could combine efforts. Regards, Fridolin Pokorny [1] https://github.com/fridex/af_ktls