netdev - Re: [PATCH] net-xfrm: add build time cfg option to PF_KEY SHA256 to use RFC4868-compliant truncation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKD1Yr0jhPDBbNAGSY1JdT5wS7APwY-2FkAmsT1W+Y9oQwwNfw@mail.gmail.com>
Date:   Tue, 16 Oct 2018 17:14:42 +0900
From:   Lorenzo Colitti <lorenzo@...gle.com>
To:     Maciej Żenczykowski <zenczykowski@...il.com>
Cc:     Maciej Żenczykowski <maze@...gle.com>,
        David Miller <davem@...emloft.net>,
        Steffen Klassert <steffen.klassert@...unet.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        netdev@...r.kernel.org
Subject: Re: [PATCH] net-xfrm: add build time cfg option to PF_KEY SHA256 to
 use RFC4868-compliant truncation

On Tue, Oct 16, 2018 at 5:06 PM Maciej Żenczykowski
<zenczykowski@...il.com> wrote:
> +config XFRM_HMAC_SHA256_RFC4868
> +       bool "Strict RFC4868 hmac(sha256) 128-bit truncation"
> +       depends on XFRM_ALGO
> +       default n
> +       ---help---
> +         Support strict RFC4868 hmac(sha256) 128-bit truncation
> +         (default on Android) instead of the default 96-bit Linux truncation.

Not sure it's worth mentioning Android here, given that other
contributors from other organizations have attempted to change this as
well.

>         .uinfo = {
>                 .auth = {
> +#if IS_ENABLED(CONFIG_XFRM_HMAC_SHA256_RFC4868)
> +                       .icv_truncbits = 128,
> +#else
>                         .icv_truncbits = 96,
> +#endif

Also, consider adding a Tested: line saying that this allows
pf_key_test.py to pass on upstream kernels.

Other than that,

Acked-By: Lorenzo Colitti <lorenzo@...gle.com>