Re: [PATCH 2/3] AF_ALG: Drop support for off-CPU cryptography

[Eric Biggers]

On Sat, Jul 25, 2026 at 10:55:03PM +0200, Richard Weinberger wrote:
> Speaking of CAAM, there is a legit usecase which exists mainline. No
> vendor patches needed.
> 
> You can create a CAAM BLOB (a generated and sealed key) using the
> trusted keys subsystem and use this BLOB
> later in AF_ALG to perform AES with a key invisible to userspace.
> 
> e.g.
> kid=$(keyctl add trusted mykey "new 32 pk" @s)
> keyctl print $kid | xxd -r -p > blob.bin
> Then just create a caam_pkey_info in userspace and feed it into AF_ALG
> and perform AES with it.

Well, specifically AES-CBC.  That's the only one that is in the driver.

> So, pretty please,  if you kill AF_ALG and all this, offer some way to
> achieve the same in userspace.

If needed, "cbc(paes)" and/or "cbc-paes-caam" (whichever name it is
being accessed as) can be allowed as a special case, as a stop-gap.

This would need confirmed use of that specific algorithm with upstream,
which we don't quite have yet.  Dominique had a confirmed use of
"tk(cbc(aes))", but that has never existed upstream in the first place,
so it's not something that could be allowlisted upstream.

You've only mentioned that it "can" be used in this way in upstream.
Can you confirm that it *is* used, and with an actual upstream algorithm
name, and if so which one(s)?  And if so, would you also be able to
share whether this is for dm-crypt or not?  We should remember that
dm-crypt accepts keys directly and AF_ALG is not needed to use it.

- Eric