Re: [PATCH 0/3] crypto: Remove arch-optimized des and des3_ede code

[Ard Biesheuvel]

On Fri, 27 Mar 2026, at 18:24, Eric Biggers wrote:
> On Fri, Mar 27, 2026 at 06:59:21PM +0900, Simon Richter wrote:
...
>> However, even from the "crypto" perspective I believe that we can't get
>> around support for asynchronous offload devices, because of mobile devices.
>> I suspect no one would be building dedicated silicon for asynchronous AES
>> into mobile CPUs if that wasn't worth it somehow
>
> They do it anyway.  It's a checkbox feature.  I.e. the purpose is for it
> to be advertised on a list of features.
>

Often, h/w crypto IP blocks are part of the SoC-specific authenticated/confidential boot chain, which is anchored in the mask ROM. Nobody wants to put software implementations of RSA and AES in there, and so it offloads the crypto processing to a h/w block instead. Since the h/w block is there, it can be used by the OS too, but that doesn't mean doing so makes any sense.

Only h/w accelerators with multiple internal queues can generally keep up with the CPUs and network/block I/O in a meaningful manner, and those are quite rare IME.