0

Is cryptography implemented in user space or kernel space?

Are public/private key pairs generated in the kernel space?

What about encryption or decryption using a given public key or a given private key, or signing a file cryptographically?

Which system calls are used for these operations and how is the private key passed in/retrieved?

I've spent some time looking at the "Asymmetric Cipher Algorithm Definitions" page here: https://www.kernel.org/doc/html/v4.10/crypto/api-akcipher.html but I can't make heads or tails of what functions do what, and what the data structures in their parameters and returns are.

Simply put, which element of which structure corresponds to the private keys?

Improve this question
1
  • If someone could tell me why I'm losing points, I could change my approach to the community or modify my question to be more in line with community standards.
    – solumnant
    Dec 20, 2019 at 21:05

2 Answers 2

Reset to default
1

The documentation you found is mainly for kernel and library development. Cryptographic primitives are used in places such as the IPSec stack, that need to run in the kernel. As you can see in the User Space Interface chapter, public key cryptography is not accessible in userspace. Even if it were, you shouldn't be concerned, where the keys end up (hint: see those nice opaque __ctx members?). The interesting part is the functions that are provided.

If you are interested in cryptographic libraries on Linux, OpenSSL, GnuTLS and Libgcrypt are probably the most common choices. There is also a comparison page on Wikipedia. These run mostly in userspace and use the kernel Crypto API to improve performance.

Edit: if you really want to use the Crypto API, you can look on a per algorithm basis what those __ctx members contain. E.g. if you look at rsa.c, you'll notice that the __ctx member of crypto_akcipher points to a struct rsa_mpi_key and you can get it with rsa_get_key().

Improve this answer
3
  • I'm interested in kernel development and malware analysis/RE so I thought it would be fun to write a toy Linux rootkit. I wanted to hook cryptography related system calls to harvest private and symmetric keys. I know there are probably easier ways to accomplish this in the user space, but I wanted to see how hooking system calls works and I thought that cryptography would be an interesting place to go. No, this isn't intended for production, I just want a resume builder and a little bit of kernel dev experience before I contribute to open source.
    – solumnant
    Dec 21, 2019 at 18:16
  • I added some details where to look for a key.
    – Piotr P. Karwasz
    Dec 23, 2019 at 8:29
  • Once I get started on this project I'll see if I want to accept this answer. Another idea I had was to debug a crypto call down to where it hits the syscall level, which would be a better living example of what goes on than the documentation.
    – solumnant
    Jan 6, 2020 at 19:53
0

Another possible solution would be to debug some code down to the syscall level to find where it interfaces with the kernel, since it seems as though the kernel reads from a buffer to perform crypto system calls.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .