[OpenAFS-devel] A crypto layer for OpenAFS

[Jeffrey Hutzelman]

--On Saturday, October 10, 2009 12:15:56 PM -0400 Marcus Watts 
<mdw@umich.edu> wrote:

> If what you have does not require significant local patches, then
> you should use heimdal as an external package.

In cases where we have user-mode components with dependencies on Kerberos, 
yes, we should certainly do that.  If possible, it should also be possible 
to build such components against MIT Kerberos.  Similarly, where we have 
user-mode components with direct crypto dependencies, it would be nice to 
be able to build them against whatever existing crypto library is available.

For in-kernel use, we cannot simply "use Heimdal as an external package", 
because Heimdal, like virtually every other package in this or any other 
space, simply does not provide libraries in a well-understood place and 
format for use in kernel code.  There are a variety of reasons for that, 
but ultimately, we have three choices:

(1) depend on interfaces the kernel provides
(2) depend on interfaces some other kernel module provides
(3) include our own

(1) doesn't work everywhere, because not all kernels provide the interfaces 
we need.  In fact, offhand I'm not aware of any kernel that exports to 
kernel modules an interface to an RFC3961 implementation.

(2) only works if you have such a module, and the OS allows for that.  I 
would certainly entertain an argument for using a separately-packaged 
third-party crypto/3961 kernel module, if such a thing existed.

That leaves (3), which is what Simon proposed.