Google kernel developer Eric Biggers has landed a series of new library APIs for Linux 7.3, overhauling how the operating system handles standard AES encryption modes. According to patch documentation submitted by Biggers, the changes replace legacy APIs that have long burdened in-kernel users with inefficiency and complexity.
New Library APIs Target Core AES Modes
The newly merged code establishes dedicated library support for widespread encryption standards including ECB, CBC, CBC-CTS, CTR, XCTR, XTS, GCM, and CCM. Previously, kernel subsystems relying on these modes had to interface through the crypto_skcipher or crypto_aead application programming interfaces. Biggers noted in his pull request that the lack of proper, streamlined library support stood as the primary gap in the kernel’s cryptographic infrastructure.
The implementation builds directly on top of existing single-block AES library support. Developers fully documented the new functions, migrated existing users, and wired the new library routines into the traditional crypto API framework. This integration ensures that the updated functions undergo standard self-testing and provide immediate fallback capability for systems lacking architecture-optimized code.
Reducing Redundant Glue Code and Optimizing Performance
Eliminating code duplication drives this ongoing modernization effort. According to the pull request details provided by Biggers, standardizing these modes paves the way to migrate architecture-optimized assembly and C routines—located in arch//crypto/aes—directly into the central library. That migration will strip away massive amounts of redundant glue code in future kernel cycles.
Biggers explained that handling these AES modes individually was not feasible because they are tightly coupled and depend heavily on one another within optimized codebases. While immediate performance gains will compound as specific architecture code gets transitioned in upcoming releases, cleaning up the foundational APIs represents the vital first step.
Did you know?
Frequently Asked Questions
Which AES modes are affected by the Linux 7.3 updates?
The updates cover ECB, CBC, CBC-CTS, CTR, XCTR, XTS, GCM, and CCM encryption modes.
Why were the old crypto_skcipher and crypto_aead APIs replaced?
According to developer documentation, the legacy APIs proved difficult to use and inefficient for standard AES encryption tasks.
When will performance improvements from these changes be visible?
While the APIs are merged now, major performance gains and code reductions will arrive in later kernel cycles as architecture-optimized cryptographic routines are migrated into the library.
Got thoughts on this kernel subsystem update? Join the discussion below or subscribe to our newsletter for more technical deep dives into open-source infrastructure.
Related reading