TechPrufer
Sign inGet started

Blogs›Cloudflare›Linux Kernel Crypto API Integration

Linux Kernel Crypto API Integration

Linux Kernel Crypto API Integration

4
posts
2015–2023

Cloudflare is exploring and implementing the Linux Kernel Crypto API for user applications to enhance security and performance. This involves understanding the API's system call interface, cryptographic parameter negotiation via /proc/crypto, and leveraging hardware acceleration like AES-NI. The focus is on evaluating the performance trade-offs between kernel-space cryptography and user-space libraries like OpenSSL, particularly for AES-CTR encryption. This exploration extends to integrating the Go programming language with these kernel-level cryptographic capabilities, including the development of assembly implementations for performance-critical algorithms like AES-GCM and Elliptic Curves (P256) to match or exceed the performance of state-of-the-art libraries like OpenSSL. This fork of Go aims to bring these performance improvements to the wider community.

2023

The Linux Crypto API for user applications

5/11/2023

This post introduces the Linux Kernel Crypto API as a mechanism for user applications to leverage kernel-level cryptographic operations. It details how to interact with the API via system calls, discover supported algorithms and drivers from /proc/crypto, and select optimized implementations (e.g., AES-NI). The post also benchmarks AES-CTR encryption performance using the kernel API against OpenSSL, highlighting the potential benefits and overheads of kernel-space cryptography. It discusses the integration with the Linux Kernel Key Retention Service for secure key management and explores the zero-copy interface for efficient data handling.

2022

The Linux Kernel Key Retention Service and why you should use it in your next application

11/28/2022

This post introduces the Linux Kernel Key Retention Service as a mechanism to protect cryptographic keys from memory access violations. It explains how the service operates by storing keys in kernel space, isolated from user-space processes, and provides an interface via system calls for allowed applications to perform cryptographic operations. The post details the key and keyring entities, special keyrings (process and user), and the asymmetric key type for holding private keys. It highlights the advantages of using the kernel service over traditional agent processes, such as reduced development overhead and enforced ACLs.

2019

eBPF can't count?!

5/3/2019

This post details a bug in the eBPF verifier that incorrectly rewrites 64-bit subtractions when running as an unprivileged user, leading to incorrect results. The bug was introduced as a mitigation for CVE-2019-7308 (Spectre variant 1). The post explores workarounds using 32-bit ALU operations and LLVM IR manipulation to achieve correct 64-bit subtraction in eBPF programs. It also highlights the importance of the Linux kernel's eBPF verifier in ensuring program safety and the impact of security fixes on existing functionality.

2015

Go crypto: bridging the performance gap

5/7/2015

This post details Cloudflare's creation of assembly implementations for AES-GCM and P256 Elliptic Curves in Go, aiming to bridge the performance gap with libraries like OpenSSL. It highlights the significant speedups achieved (e.g., 23.4X for AES-128-GCM) and explains the technical details of AES-GCM as an AEAD. The post also mentions improvements to Go's RSA implementation and the availability of a special Go fork with these enhancements.