Re: [PATCH v3 2/2] rust: crypto: add synchronous RSA akcipher support

[Eric Biggers]

On Wed, Aug 26, 2026 at 05:29:49PM +0100, Mike Lothian wrote:
> +config RUST_CRYPTO_LIB_AES
> +	bool
> +	depends on RUST
> +	select CRYPTO_LIB_AES
> +	select CRYPTO_LIB_AES_CBC_MACS
> +	help
> +	  Enable the Rust bindings for the synchronous AES library functions.
> +	  The selected C libraries are built into the kernel because Rust
> +	  abstractions are part of the built-in kernel crate.

This is being added in the wrong patch.

>  config CRYPTO_LIB_AESGCM
>  	tristate
>  	select CRYPTO_LIB_AES
> @@ -216,6 +226,15 @@ config CRYPTO_LIB_SHA256
>  	  Select this if your module uses any of these functions from
>  	  <crypto/sha2.h>.
>  
> +config RUST_CRYPTO_LIB_SHA256
> +	bool
> +	depends on RUST
> +	select CRYPTO_LIB_SHA256
> +	help
> +	  Enable the Rust bindings for the synchronous SHA-256 and HMAC-SHA256
> +	  library functions. The selected C library is built into the kernel
> +	  because Rust abstractions are part of the built-in kernel crate.

Likewise.

As I've been commenting on other of these bindings patches, it also
doesn't really make sense to have the kconfig symbol be in lib/ but then
have the actual code be in rust/.  They should be in the same place.

> +__rust_helper void rust_helper_memzero_explicit(void *s, size_t count)
> +{
> +	memzero_explicit(s, count);
> +}

Isn't there a standard Rust solution for this?

> +#ifdef CONFIG_RUST_CRYPTO_AKCIPHER
> +__rust_helper void rust_helper_crypto_free_akcipher(struct crypto_akcipher *tfm)
> +{
> +	crypto_free_akcipher(tfm);
> +}

If you need RSA, then please just create an API for RSA specifically.
The crypto_akcipher abstraction has never worked well, due to
differences between the algorithms and various other reasons.

> +__rust_helper void rust_helper_aes_enckey_zero(struct aes_enckey *key)
> +{
> +	memzero_explicit(key, sizeof(*key));
> +}

Similarly, isn't there a standard Rust solution to zeroize memory?

- Eric