Zinc: a new kernel cryptography API

But that doesnt mean that all API's have to contain opaque blobs.

I would agree that the set of mechanisms that are used to programatically access the functionality of a package are the API of the package.

Just because there are many bad complicated API's out there doesnt mean all API's have to be confusing and complicated.

There's no scatter-gather needed or anything beyond basic socket handling (socket, bind, setsockopt, accept, write/sendto, read/recvfrom) but it's half the speed or slower than other approaches due to all the resulting syscalls in testing PBKDF2 for example, versus a standalone library. Upside? It's <800 bytes compiled for a full PBKDF2 implementation w/ proper error checking and fail-out.

But for a constant-stream-of-data system like a VPN or if you're trying to go As Fast As Possible? Yeah, it's sucky complexity once you hit using the scatter-gather functions instead or try to gin things up with zero-copy.

The existing kernel crypto API is meant to avoid having to roll your own libraries, and get faster versions if they're available, but it's got a lot of fixed overhead either in code complexity to make it scream, or syscall count if you don't care about speed.