linux-kernel - [PATCH 2.6.26rc5] xfrm: SHA-256/384/512 HMAC support for IPsec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 05 Jun 2008 15:06:51 +0200
From:	Martin Willi <martin@...ongswan.org>
To:	herbert@...dor.apana.org.au, davem@...emloft.net
Cc:	linux-kernel@...r.kernel.org
Subject: [PATCH 2.6.26rc5] xfrm: SHA-256/384/512 HMAC support for IPsec

RFC4868 defines the use of SHA256, SHA384 and SHA512 in HMAC using 128,
192 and 256 bits truncation. This patch replaces the outdated SHA256
algorithm with 96 bits truncation by the 128 bit variant and adds the
SHA384/512 algorithms.

Signed-off-by: Martin Willi <martin@...ongswan.org>

---
Replacing the 96 bit truncation SHA256 algorithm might be problematic,
but it is obsolete in IPsec and I don't see a way to register two
different truncation lengths in XFRM.

--- a/net/xfrm/xfrm_algo.c 2008-06-05 14:01:01.000000000 +0200
+++ b/net/xfrm/xfrm_algo.c 2008-06-05 14:39:31.000000000 +0200
@@ -187,7 +187,7 @@
 
 	.uinfo = {
 		.auth = {
-			.icv_truncbits = 96,
+			.icv_truncbits = 128,
 			.icv_fullbits = 256,
 		}
 	},
@@ -200,6 +200,42 @@
 	}
 },
 {
+	.name = "hmac(sha384)",
+	.compat = "sha384",
+
+	.uinfo = {
+		.auth = {
+			.icv_truncbits = 192,
+			.icv_fullbits = 384,
+		}
+	},
+
+	.desc = {
+		.sadb_alg_id = SADB_X_AALG_SHA2_384HMAC,
+		.sadb_alg_ivlen = 0,
+		.sadb_alg_minbits = 384,
+		.sadb_alg_maxbits = 384
+	}
+},
+{
+	.name = "hmac(sha512)",
+	.compat = "sha512",
+
+	.uinfo = {
+		.auth = {
+			.icv_truncbits = 256,
+			.icv_fullbits = 512,
+		}
+	},
+
+	.desc = {
+		.sadb_alg_id = SADB_X_AALG_SHA2_512HMAC,
+		.sadb_alg_ivlen = 0,
+		.sadb_alg_minbits = 512,
+		.sadb_alg_maxbits = 512
+	}
+},
+{
 	.name = "hmac(rmd160)",
 	.compat = "rmd160",



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/