From Fedora Project Wiki
(Contingency Plan)
Line 50: Line 50:
== Contingency Plan ==
== Contingency Plan ==
<!-- If you cannot complete your feature by the final development freeze, what is the backup plan?  This might be as simple as "None necessary, revert to previous release behaviour."  Or it might not.  If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy. -->
None necessary for the required parts of the feature. We would simply not ship the library if it is not completed.
== Documentation ==
== Documentation ==

Revision as of 07:33, 13 July 2010

Feature: Dev Crypto Userspace API


Allow the user space applications directly or indirectly through existing crypto libraries interfacing with the kernel crypto implementation.


Current status

  • Targeted release: Fedora XX
  • Last updated: 2010-07-13
  • Percentage of completion: 5%

Detailed Description

The /dev/crypto is a special device which is currently in development for the upstream kernel inclusion. This device allows user space applications to directly call the cryptographic routines that are part of the Linux kernel code. Similar device is available also on other kernels.

Separation of the cryptographic primitives into the kernel allows fulfilling the requirements of the new U.S. Government standards (such as FIPS-140-3) in regards to the implementation and usage of the cryptographic algorithms on general purpose operating systems.

This separation allows isolation of the private and secret keys from the user space applications so these critical security parameters (CSP) are not leaked in case the user space applications are for example exploited by malicious users. It also allows proper auditing of any administrative manipulation with these CSP.

Benefit to Fedora

Fedora will be able to declare being the leader in developing and enabling users of the cryptographic algorithms to comply with the newest government standards.


Required steps are:

  • /dev/crypto interface built into the kernel
  • user space library allowing easy access to the /dev/crypto interface

Optional steps (maybe a feature for Fedora 15):

  • PKCS#11 module directly pluggable into the Mozilla NSS crypto library
  • Configurable replacement of the crypto implementation in other system crypto libraries such as OpenSSL or libgcrypt

How To Test

The accomplishment of this feature does not require much testing. Mainly the testing will be provided by the tests included in the build of the user space API library. More testing will need to be done when the integration with the existing system crypto libraries is implemented. This testing will be necessary to ensure that by using this kernel API instead of the native crypto algorithm implementations the crypto algorithms supported still work correctly.

User Experience

No visible changes.


None external dependencies.

Contingency Plan

None necessary for the required parts of the feature. We would simply not ship the library if it is not completed.


Release Notes

Comments and Discussion