lkml.org 
[lkml]   [1998]   [Aug]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: CIPE - Encrypted IP Encapsulation
Date
From
> I've been thinking about this lately.  There are beginning to be quite
> some crypto-patches to the kernel and to be more accessible and reduce
> bloat (not duplicating DES 5 times), I think an up-to-date
> "international version" of linux is needed, and a team to maintain it.

First we'd need to agree on a crypto API. This could be as simple as

int crypt_get_cipher(const char *name);
/* e.g.: if ((hndl=crypt_get_cipher("blowfish"))<0) return hndl;
will allocate space for the key, and return a handle to this
cipher instance, <0 on error
requests the proper cipher module
*/
int crypt_key_setup(int hndl, const char *key);
int crypt_encipher_stream(int hndl, const char *src, char *dest, size_t len);
int crypt_decipher_stream(int hndl, const char *src, char *dest, size_t len);
int crypt_encipher_ecb(int hndl, const char *src, char *dest);
int crypt_decipher_ecb(int hndl, const char *src, char *dest);
int crypt_encipher_cbc(int hndl, const char *src, char *dest, size_t len, const char *iv);
int crypt_decipher_cbc(int hndl, const char *src, char *dest, size_t len, const char *iv);

Shouldn't be that hard to make a generic module out of that, and then
rewrite the encrypting modules to use that instead of their homegrown
stuff. And make the actual encryption algorithms into modules that
register themselves like

struct crypt_cipher {
char name[8];
int blocksize; /* 1=stream */
void *new(); /* returns internal handle */
int destroy(void *hndl);
int key_setup(void *hndl, const char *key);
int encipher(void *hndl, const char *src, char *dest, size_t len);
int decipher(void *hndl, const char *src, char *dest, size_t len);
};

int crypt_register(struct crypt_cipher *c);
/* maybe even make a /proc entry? */

> The important part of this is to get the infrastructure right. A
> patch distributed "together" with the normal kernel would be immensely
> more useful than an obscure patch distributed from some far-away
> place. What I was thinking was to make a primary international site
> that mirrors ftp.kernel.org an "overlays" a patch-crypto-x.y.z.gz file
> in the v2.{0,1} catalogs. This is not a new idea, but similar to the

The actual patch should be small enough to just add the necessary
hooks into the loopback device, networking etc. I'd prefer to make
modules out of the rest if possible.

olaf


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.142 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site