[PATCH 2.6.26rc5] xfrm: SHA-256/384/512 HMAC support for IPsec

[Martin Willi]

RFC4868 defines the use of SHA256, SHA384 and SHA512 in HMAC using 128,
192 and 256 bits truncation. This patch replaces the outdated SHA256
algorithm with 96 bits truncation by the 128 bit variant and adds the
SHA384/512 algorithms.

ïSigned-off-by: Martin Willi <martin@xxxxxxxxxxxxxx>

---
Replacing the 96 bit truncation SHA256 algorithm might be problematic,
but it is obsolete in IPsec and I don't see a way to register two
different truncation lengths in XFRM.

--- a/net/xfrm/xfrm_algo.c 2008-06-05 14:01:01.000000000 +0200
+++ b/net/xfrm/xfrm_algo.c 2008-06-05 14:39:31.000000000 +0200
@@ -187,7 +187,7 @@
 
 	.uinfo = {
 		.auth = {
-			.icv_truncbits = 96,
+			.icv_truncbits = 128,
 			.icv_fullbits = 256,
 		}
 	},
@@ -200,6 +200,42 @@
 	}
 },
 {
+	.name = "hmac(sha384)",
+	.compat = "sha384",
+
+	.uinfo = {
+		.auth = {
+			.icv_truncbits = 192,
+			.icv_fullbits = 384,
+		}
+	},
+
+	.desc = {
+		.sadb_alg_id = SADB_X_AALG_SHA2_384HMAC,
+		.sadb_alg_ivlen = 0,
+		.sadb_alg_minbits = 384,
+		.sadb_alg_maxbits = 384
+	}
+},
+{
+	.name = "hmac(sha512)",
+	.compat = "sha512",
+
+	.uinfo = {
+		.auth = {
+			.icv_truncbits = 256,
+			.icv_fullbits = 512,
+		}
+	},
+
+	.desc = {
+		.sadb_alg_id = SADB_X_AALG_SHA2_512HMAC,
+		.sadb_alg_ivlen = 0,
+		.sadb_alg_minbits = 512,
+		.sadb_alg_maxbits = 512
+	}
+},
+{
 	.name = "hmac(rmd160)",
 	.compat = "rmd160",



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/