RE: [PATCH v2] drivers: misc: Add support for nCipher HSM devices

[Kim, David]

> >
> > This is the driver for nCipherâs Solo and Solo XC hardware security modules.
> > These modules implement a proprietary command set (the ânCore APIâ) to
> > perform cryptographic operations - key generation, signature, and so
> > on. HSM commands and their replies are passed in a serialised binary
> > format over the PCIe bus via a shared memory region. Multiple commands
> > may be in-flight at any one time - command processing is
> > multi-threaded and asynchronous. A write operation may, therefore,
> > deliver multiple commands, and multiple replies may be retrieved in one
> read operation.
> 
> If this is "just" a crypto accelerator, why isn't this driver using the existing in-
> kernel hardware crypto api?  What is lacking from it that you need here?

Hi Greg,

A cryptographic accelerator uses key material which is stored on, and managed by, the host machine. Hardware security modules, such as nCipherâs Solo products, retain key material (i.e. secrets) within the secure boundary of the device, and implement various forms of access control to restrict use of that key material.

nCipher's product range started, in the early 1990s, as cryptographic accelerators.  The series of hardware security modules served by this driver still does do cryptography but their main function is the generation, management and use of keys within a secure boundary.

The driver doesn't do any cryptography. It provides the link between the userspace software and the HSM's firmware. Cryptography is done within the HSM's secure boundary.

Regards
Dave