Linux Security Summit North America 2026

The Linux kernel's cryptography framework has long been a source of frustration for developers. Its complex and abstract API is often a poor fit for modern algorithms and hardware. Using it correctly is quite difficult, and its performance is suboptimal due to the required dynamic memory allocations, indirect calls, and other API overhead.

This talk presents recent progress in supporting more algorithms via straightforward library APIs, including hash functions, MACs, and CRCs. We will explore how various kernel subsystems have been refactored to use these libraries, simplifying their code and improving performance.

Finally, I will also cover best practices for adding new kernel features that use cryptography, the adoption of modern practices in the crypto library such as KUnit testing, and new features in the crypto library such as support for the SHAKE extendable-output functions and ML-DSA post-quantum signatures.