Re: [PATCH net-next v8 28/28] net: WireGuard secure network tunnel

2018-10-25 Thread Jason A. Donenfeld
Hi Andrew, On Fri, Oct 26, 2018 at 12:53 AM Andrew Lunn wrote: > > This is on the hot path, actually. Well, it's not on path of data > > packets, but I do consider handshake packets to be fairly "warm". > > So for me, hot path is something called 10 million timers per > second. How often do hands

Re: [PATCH net-next v8 28/28] net: WireGuard secure network tunnel

2018-10-25 Thread Jason A. Donenfeld
Hi Andrew, On Fri, Oct 26, 2018 at 12:37 AM Andrew Lunn wrote: > I can understand that. But on the flip side, CAKE reached something > like version 19 before it got merged. Wireguard is looking similar. > An addition like the above, is not controversial. You could submit > such a single patch in

Re: [PATCH net-next v8 28/28] net: WireGuard secure network tunnel

2018-10-25 Thread Jason A. Donenfeld
Hi Andrew, On Fri, Oct 26, 2018 at 12:44 AM Andrew Lunn wrote: > Out of tree is important here. To some degree, mainline does not care > about out of tree drivers. Putting in a bandaid for them does not help > get them fixed. > > I would drop this bandaid. If the Android community decides to move

Re: Crypto Update for 4.20

2018-10-25 Thread Linus Torvalds
On Tue, Oct 23, 2018 at 3:10 AM Herbert Xu wrote: > > Here is the crypto update for 4.20: Pulled. > Please note that there is a conflict with the compiler-attributes > tree as one of the lines that was removed by a patch in the crypto > tree was moved to a different file in the compiler-attribut

Re: [PATCH net-next v8 28/28] net: WireGuard secure network tunnel

2018-10-25 Thread Andrew Lunn
> > > +static void kdf(u8 *first_dst, u8 *second_dst, u8 *third_dst, const u8 > > > *data, > > > + size_t first_len, size_t second_len, size_t third_len, > > > + size_t data_len, const u8 chaining_key[NOISE_HASH_LEN]) > > > +{ > > > + u8 output[BLAKE2S_HASH_SIZE + 1]; >

Re: [PATCH net-next v8 28/28] net: WireGuard secure network tunnel

2018-10-25 Thread Andrew Lunn
> > > +#if defined(CONFIG_PM_SLEEP) && !defined(CONFIG_ANDROID) > > > > I don't see any other code which uses this combination. Why is this > > needed? > > WireGuard clears private key material before going to sleep, so that > ephemeral keys never live longer in ram than their expiration date. > T

Re: [PATCH net-next v8 28/28] net: WireGuard secure network tunnel

2018-10-25 Thread Andrew Lunn
> > > + net_dbg_ratelimited("%s: Could not decrypt invalid cookie > > > response\n", > > > + wg->dev->name); > > > > It might be worth adding a netdev_dbg_ratelimited(), which takes a > > netdev as its first parameter, just line netdev_dbg(). > > That s

Re: [PATCH 2/3] dt-bindings: Add ICE device specific parameters

2018-10-25 Thread Rob Herring
On Wed, Oct 17, 2018 at 08:47:55PM +0530, AnilKumar Chimata wrote: > Add dt parameters information specific to the Inline > Crypto Engine (ICE) device. > > Signed-off-by: AnilKumar Chimata > --- > .../devicetree/bindings/crypto/msm/ice.txt | 34 > ++ > 1 file changed

Re: [PATCH v4 2/7] tpm2-sessions: Add full HMAC and encrypt/decrypt session handling

2018-10-25 Thread Jarkko Sakkinen
On Wed, 24 Oct 2018, James Bottomley wrote: +static void KDFa(u8 *key, int keylen, const char *label, u8 *u, +u8 *v, int bytes, u8 *out) Should this be in lower case? I would rename it as tpm_kdfa(). This one is defined as KDFa() in the standards and it's not TPM specific (alt

Re: [PATCH 3/3] crypto: qce: ice: Add support for Inline Crypto Engine

2018-10-25 Thread Rob Herring
On Thu, Oct 25, 2018 at 10:29 AM Theodore Y. Ts'o wrote: > > On Thu, Oct 25, 2018 at 09:55:48AM -0500, Rob Herring wrote: > > > +Introduction: > > > += > > > +Storage encryption has been one of the most required feature from > > > security > > > +point of view. QTI based storage encry

Re: [PATCH v4 0/7] add integrity and security to TPM2 transactions

2018-10-25 Thread Jarkko Sakkinen
On Wed, 24 Oct 2018, James Bottomley wrote: On Wed, 2018-10-24 at 02:51 +0300, Jarkko Sakkinen wrote: I would consider sending first a patch set that would iterate the existing session stuff to be ready for this i.e. merge in two iterations (emphasis on the word "consider"). We can probably merg

Re: [PATCH 3/3] crypto: qce: ice: Add support for Inline Crypto Engine

2018-10-25 Thread Theodore Y. Ts'o
On Thu, Oct 25, 2018 at 09:55:48AM -0500, Rob Herring wrote: > > +Introduction: > > += > > +Storage encryption has been one of the most required feature from security > > +point of view. QTI based storage encryption solution uses general purpose > > +crypto engine. While this kind of so

Re: [PATCH 3/3] crypto: qce: ice: Add support for Inline Crypto Engine

2018-10-25 Thread Rob Herring
On Wed, Oct 24, 2018 at 04:44:37PM +0530, an...@codeaurora.org wrote: > Hi, > > Thanks for the comments, response inline. FYI, this was from a bot. > > Thanks, > AnilKumar > > > On 2018-10-18 17:13, kbuild test robot wrote: > > Hi AnilKumar, > > > > Thank you for the patch! Yet something to

Re: [PATCH 3/3] crypto: qce: ice: Add support for Inline Crypto Engine

2018-10-25 Thread Rob Herring
On Wed, Oct 17, 2018 at 08:47:56PM +0530, AnilKumar Chimata wrote: > This patch adds support for Inline Crypto Engine (ICE), which > is embedded into storage device/controller such as UFS/eMMC. > ICE is intended for high throughput cryptographic encryption > or decryption of storage data. > > Sign

Re: [PATCH net-next v8 28/28] net: WireGuard secure network tunnel

2018-10-25 Thread Jason A. Donenfeld
Hi Andrew, Thanks for the review. Comments and fix links are inline below. On Sun, Oct 21, 2018 at 12:47 AM Andrew Lunn wrote: > > > +#define choose_node(parent, key) > > \ > > + parent->bit[(key[parent->bit_at_a] >> parent->bit_at_b) & 1] > Thi

Re: [PATCH] crypto: caam/qi - simplify CGR allocation, freeing

2018-10-25 Thread Horia Geanta
On 10/9/2018 8:11 PM, Sebastian Andrzej Siewior wrote: > On 2018-10-08 14:09:37 [+0300], Horia Geantă wrote: >> CGRs (Congestion Groups) have to be freed by the same CPU that >> initialized them. >> This is why currently the driver takes special measures; however, using >> set_cpus_allowed_ptr() is

Re: dm-integrity stalls with iMX6q CAAM

2018-10-25 Thread Neil Armstrong
On 17/10/2018 15:35, Horia Geanta wrote: > On 9/21/2018 3:06 PM, Neil Armstrong wrote: >> Hi, >> >> I recently configured dm-crypt + dm-integrity on an iMX6q platform with CAAM >> Hash functions enabled using the following command lines : >> >> Linux 4.14.71 >> >> cryptsetup luksFormat /dev/mmcblk