How can i add more algorithm in cryptoAPI in linux

Question

When i check /proc/crypto it shows me:

abhi@ubuntu:/proc$ cat crypto 
name         : stdrng
driver       : krng
module       : kernel
priority     : 200
refcnt       : 1
selftest     : passed
type         : rng
seedsize     : 0

name         : md5
driver       : md5-generic
module       : kernel
priority     : 0
refcnt       : 1
selftest     : passed
type         : shash
blocksize    : 64
digestsize   : 16

I need to use aes256 for one of my projects.

Can someone point out how I can add this algo to crypto api or is there any other way i can achieve this in (ubuntu 10.4, 2.6.32-35).

Is there a list of supported (by default) algorithms that are implemented with the cryptoapi for kernel 2.6?

Answer 1

Abhi, Kernel crypto API was created in 2002 for protocols, which requires cryptography inside the kernel (in the kernel mode, when you has no reliable way of using user-space crypto):

Although initially aimed at supporting IPSec, the API has been designed as a general-purpose facility, with potential applications including encrypted files, encrypted filesystems, strong filesystem integrity, the random character device (/dev/random), network filesystem security (for example, CIFS) and other kernel networking services requiring cryptography.

So, If you are working in the user-space and has no plans to move into kernel as new FS or new part of network stack, it is easier and more portable to use user-space library for crypto. User-space lib may use or not use kernel API for some ciphers, but likely it will use user-space implementation. There are a lot of such libs, e.g. openssl, Libgcrypt etc. Some huge frameworks, like Qt may include some popular crypto too.

To expand cryptoapi in kernel with new algo you should have this algo implemented and compiled for your kernel (either as module or as part of kernel binary). To find name of modules compiled for your kernel, try ls /lib/modules/*/*/arch/*/crypto/ /lib/modules/*/*/crypto/; then you can call for example modprobe aes_generic or modprobe aes-x86_64 to load additional crypto module in API.

After modprobe aes-x86_64 I have:

# cat /proc/crypto |grep aes
name         : aes
driver       : aes-asm
module       : aes_x86_64
name         : aes
driver       : aes-generic
module       : aes_generic

Answer 2

you can take aes-generic.c as an example