Supporting hardware crypto in the kernel [LWN.net]

Now that the kernel has its own cryptographic API, James Morris is thinking about how to support cryptographic hardware. A number of cards which perform cryptographic functions exist, and it would be nice to be able to make full use of these cards with a Linux system. Quite a few issues need to be considered on the way there, however, including:

How should multiple cards be supported? This gets tricky, especially for session-oriented crypto operations.
How should card failures (and resource exhaustion) be handled? The current crypto API isn't designed around this sort of failure.
Some network cards can do their own IPsec processing; taking advantage of that capability may require a higher-level interface.
User space may want to be able to use cryptographic devices as well, meaning that some sort of interface needs to be designed.
Many devices lack useful programming documentation, which will make creating a Linux driver harder (or impossible).

And so on. Now is the time to get these decisions right; anybody who is interested in the interface to cryptographic hardware should probably have a look at James's posting and join the discussion.