Re: [Qemu-devel] [PATCH for-2.9 1/3] crypto: add standard des support

["Daniel P. Berrange" <berrange@redhat.com>]

On Mon, Dec 05, 2016 at 07:11:37PM +0800, Longpeng (Mike) wrote:
> Hi Daniel,
> 
> On 2016/12/5 17:18, Daniel P. Berrange wrote:
> 
> > On Mon, Dec 05, 2016 at 04:59:38PM +0800, Longpeng(Mike) wrote:
> ......
> >> diff --git a/qapi/crypto.json b/qapi/crypto.json
> >> index 5c9d7d4..d403ab9 100644
> >> --- a/qapi/crypto.json
> >> +++ b/qapi/crypto.json
> >> @@ -75,7 +75,7 @@
> >>  { 'enum': 'QCryptoCipherAlgorithm',
> >>    'prefix': 'QCRYPTO_CIPHER_ALG',
> >>    'data': ['aes-128', 'aes-192', 'aes-256',
> >> -           'des-rfb',
> >> +           'des-rfb', 'des',
> > 
> > Can we call this '3des' to make it clear that this is Triple-DES and not
> > the single-DES (which des-rfb is)
> > 
> 
> As the comment in qapi/crypto.json said:
> @des-rfb: RFB specific variant of single DES.
> 
> This patch just add the standard single-DES support, not the triple-DES, so I
> think maybe "des" is suitable.

Oh I missed that - QEMU should not support single-DES at all for
cryptodev IMHO. Single DES has been cryptographically broken/useless
for *decades* - way back in 1999, the EFF built a machine that could
brute force single-DES in a mere 56 hours.

Triple-DES is the bare minimum that's acceptable and even that
should only be for legacy usage which can't use a more modern
cipher like AES

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://entangle-photo.org       -o-    http://search.cpan.org/~danberr/ :|