undefined | Better HN

0 pointsbuckle80171mo ago0 comments

You should take note that this is written by the person that wrote the bad patch.

So grain of salt.

0 comments

8 comments · 3 top-level

mihaaly1mo ago· 3 in thread

But is it true or not? Whoever wrote it. (for objective truth the subjects are unimportant)

buckle8017OP1mo ago

It might have been true in 2002 but it hasn't been true since at least about 2010.

You've almost certainly never had a system that supported any hardware accelerated crypto that also required a kernel module.

It's much easier to expose as cpu extensions.

skywhopper1mo ago

When you can’t know the objective truth or when there isn’t one (as is the case in making decisions about security tradeoffs in software design), knowing the source of the argument is vital to interpreting its validity.

bawolff1mo ago

I disagree 100%. Software security tradeoffs are definitely the sort of thing where you can evaluate arguments on their merits.

asveikau1mo ago· 2 in thread

I feel like it should be possible to fulfill these advantages with a minimal, not very complex API. I.e. the grandparent's comment about IPsec implementation details doesn't make the cut, but a hardware accelerated cipher implementation does.

amluto1mo ago

A hardware accelerated DMA-capable cipher implementation is an odd thing, and it’s generally not useful on its own. You might want to set up a whole chain of operations (encrypt, checksum, send to network, for example), but I’ve never encountered a case where you actually want to ask an accelerator to asynchronously encrypt application data and return the encrypted data to the application.

hansvm1mo ago

Unless you're pushing a ton of extra work into a network-capable accelerator, that sounds exactly like what you'd want for, e.g., an encrypted S3 implementation. You have encryption, RS encoding, striped checksumming, sending fragments to multiple hosts, some sort of potentially interesting partial failure handling, etc.

You could push that all down to the accelerator, but if there are even a few such use cases you might want a dedicated DMA-capable implementation instead.

still_grokking1mo ago

I've said I'm not sure about the validity of that reasoning.

I've liked it nevertheless for context, as augmentation to parent's post.

j / k navigate · click thread line to collapse