]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
crypto: af_alg - Drop support for off-CPU cryptography
authorDemi Marie Obenour <demiobenour@gmail.com>
Sat, 23 May 2026 19:43:03 +0000 (15:43 -0400)
committerHerbert Xu <herbert@gondor.apana.org.au>
Fri, 29 May 2026 06:05:30 +0000 (14:05 +0800)
commit7524070f26d8d347c26787dc297fb844baa26abf
tree74f0a7b9a2e653829cdc6a4f2991458e6f5f6c0d
parentfcc77d33a34cf271702e8daafb6c593e4626776d
crypto: af_alg - Drop support for off-CPU cryptography

AF_ALG is deprecated and exposed to unprivileged userspace.  Only
use the least buggy algorithm implementations: the pure software ones.

This removes one of the main advantages of AF_ALG, which is the
ability to use it with off-CPU accelerators.  However, using off-CPU
accelerators has huge overheads, both in performance and attack surface.
I have yet to see real-world, performance-critical workloads where using
an accelerator via AF_ALG is actually a win over doing cryptography in
userspace.

If using an off-CPU accelerator really does turn out to be a win, a new
API should be developed that is actually a good fit for it.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Documentation/crypto/userspace-if.rst
crypto/af_alg.c
crypto/algif_aead.c
crypto/algif_hash.c
crypto/algif_rng.c
crypto/algif_skcipher.c
include/crypto/if_alg.h