What If We Ask Linux to Do Cryptography for Us?
summary
Proposal: move private keys from user space into the Linux kernel and call crypto there from Golang or Rust via system calls, replacing user-space libraries. It shows how to provision keys into the Linux kernel key retention service (key store) with go unix.AddKey or equivalent Rust syscalls, fetch a key serial, and perform AES-CBC (128/192/256) via the Linux crypto API. Built examples work but run ~2x slower than OpenSSL due to syscall copies; zero-copy 64KB can reduce that.
AI-written summary · about
chapters (11)
- 0:00Linux cryptography intro
- 1:05Crypto basics & memory safety
- 7:36Memory leaks & process separation
- 9:03Linux key retention service
- 13:07Go with key store
- 15:57Rust with key store
- 18:44Linux Crypto API
- 21:16Go Crypto API integration
- 25:16Rust Crypto API integration
- 26:22Performance & security
- 27:27Summary & resources
related talks
55mWhat is Linux kernel keystore and why you should use it in your next application
41mWhat Is Linux Kernel Keystore and Why You Should Use It in Your Next...
58mWhat is Linux kernel keystore and why you should use it in your next application
53mWhat is Linux kernel keystore and why you should use it in your next application
43mWhat is Linux kernel keystore and why you should use it in your next app
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
47mTPMs and the Linux Kernel: unlocking a better path to hardware security
51mThe Linux Crypto API