linux-kernel - Re: [PATCH] crypto: remove md4 driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2e52c8b4-e70a-453f-853a-1962c8167dfa@gmail.com>
Date:   Fri, 13 Oct 2023 09:37:52 -0500
From:   Denis Kenzior <denkenz@...il.com>
To:     Herbert Xu <herbert@...dor.apana.org.au>,
        Dimitri John Ledkov <dimitri.ledkov@...onical.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Maxime Coquelin <mcoquelin.stm32@...il.com>,
        Alexandre Torgue <alexandre.torgue@...s.st.com>,
        linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-stm32@...md-mailman.stormreply.com,
        linux-arm-kernel@...ts.infradead.org,
        James Prestwood <prestwoj@...il.com>,
        Marcel Holtmann <marcel@...tmann.org>
Subject: Re: [PATCH] crypto: remove md4 driver

Hi Herbert,

On 10/13/23 05:39, Herbert Xu wrote:
> On Sun, Oct 08, 2023 at 05:01:39AM +0100, Dimitri John Ledkov wrote:
>> No internal users left and cryptographically insecure. Users should
>> upgrade to something else, e.g. sha256 blake3.
>>
>> Some drivers have their own full or partial md4 implementation without
>> using crypto/md4.
>>
>> Userspace code search indicates a few copies of hash_info.h
>> https://codesearch.debian.net/search?q=HASH_ALGO_MD4&literal=1 without
>> need for MD4.
>>
>> Preserve uapi hash algorithm indexes and array length, but rename the
>> MD4 enum.
>>
>> Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@...onical.com>
>> ---
>>   crypto/Kconfig                 |   6 -
>>   crypto/Makefile                |   1 -
>>   crypto/hash_info.c             |   4 +-
>>   crypto/md4.c                   | 241 ---------------------------------
>>   crypto/tcrypt.c                |  12 --
>>   crypto/testmgr.c               |   6 -
>>   crypto/testmgr.h               |  42 ------
>>   include/uapi/linux/hash_info.h |   2 +-
>>   8 files changed, 3 insertions(+), 311 deletions(-)
>>   delete mode 100644 crypto/md4.c
> 
> Patch applied.  Thanks.

Does this patch break userspace?

Here's a thread regarding MD4 the last time its removal was attempted:
https://lore.kernel.org/linux-crypto/20210818144617.110061-1-ardb@kernel.org/

Please note that iwd does use MD4 hashes here:
https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/checksum.c#n63

https://git.kernel.org/pub/scm/network/wireless/iwd.git/tree/src/eap-mschapv2.c#n165

Regards,
-Denis