NCR Linux-kernel module

The NCR API is an alternative to the OpenBSD API to access crypto services. It is being described at "A Linux-kernel cryptographic framework: Decoupling cryptographic keys from applications", and its main difference with the OpenBSD framework is that it is a complete cryptographic framework supporting all kinds of algorithms, and can be used in a way to prevent access to cryptographic keys from user-space applications.

• Self contained linux kernel module
• Separation of cryptographic keys from user-space applications (can operate as soft-HSM)
• Support for RSA, DSA and Diffie Hellman public key algorithms
• Support for all major cipher algorithms
• Support for all major hash algorithms
• Can be easily wrapped under a PKCS #11 module

In addition to the performance benefits by using hardware accelerated ciphers, the NCR framework can protect cryptographic keys from user-space access. That would mean that a worm, or another code injection attack in a server will not compromise the available cryptographic keys.

The source code is available at repo.or.cz.

Check how to use NCR by reading some example programs.

Alpha