From: Eric Biggers <ebiggers@kernel.org>
To: Hannes Reinecke <hare@suse.de>
Cc: Jarkko Sakkinen <jarkko@kernel.org>,
David Howells <dhowells@redhat.com>,
bpf@vger.kernel.org, dm-devel@lists.linux.dev,
fsverity@lists.linux.dev, keyrings@vger.kernel.org,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest@vger.kernel.org,
linux-security-module@vger.kernel.org,
Alasdair Kergon <agk@redhat.com>,
Alexei Starovoitov <ast@kernel.org>, Alex Shi <alexs@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Andrii Nakryiko <andrii@kernel.org>,
Benjamin Marzinski <bmarzins@redhat.com>,
Daniel Borkmann <daniel@iogearbox.net>,
Dongliang Mu <dzm91@hust.edu.cn>,
Eduard Zingerman <eddyz87@gmail.com>,
Emil Tsalapatis <emil@etsalapatis.com>,
Ihor Solodrai <ihor.solodrai@linux.dev>,
James Morris <jmorris@namei.org>, Jiri Olsa <jolsa@kernel.org>,
Jonathan Corbet <corbet@lwn.net>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>,
Martin KaFai Lau <martin.lau@linux.dev>,
Mike Snitzer <snitzer@kernel.org>,
Mikulas Patocka <mpatocka@redhat.com>,
Paul Moore <paul@paul-moore.com>,
Randy Dunlap <rdunlap@infradead.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
Shuah Khan <skhan@linuxfoundation.org>,
Song Liu <song@kernel.org>, "Theodore Y. Ts'o" <tytso@mit.edu>,
Yanteng Si <si.yanteng@linux.dev>,
Yonghong Song <yonghong.song@linux.dev>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: Re: [PATCH v5 2/3] KEYS: Replace assoc_array with rhashtable
Date: Fri, 6 Nov 2026 01:05:16 -0800 [thread overview]
Message-ID: <20261106090516.GA1973@sol> (raw)
In-Reply-To: <27015846-0161-4700-b810-4643e1f7b63a@suse.de>
On Fri, Nov 06, 2026 at 09:21:32AM +0100, Hannes Reinecke wrote:
> While I am pretty much in favour with this approach, is there a specific
> reason why siphash has been chosen?
SipHash is the preferred choice for secure hash tables. It is secure,
performs well on short inputs, and doesn't require special instructions.
See Documentation/security/siphash.rst
> Would there be a chance to make this configurable?
> I do see slight complications when running in secure environments
> (ie FIPS-certified environments) where most of the hash functions
> might not be available ...
SipHash support is available even when the kernel is booted with fips=1,
so there's no issue there. It's already widely used in the kernel for
hash tables, and that hasn't blocked FIPS certifications either.
Side note: fips=1 actually has little do with security, and in some
cases it actually decreases security. See for example
https://lore.kernel.org/linux-crypto/20261026183332.11402-1-ebiggers@kernel.org/
where I'm fixing a vulnerability caused by fips=1.
- Eric
next prev parent reply other threads:[~2026-11-06 9:05 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-05 3:13 [PATCH v5 0/3] KEYS: Replace assoc_array with rhashtable Jarkko Sakkinen
2026-11-05 3:13 ` [PATCH v5 1/3] KEYS: Introduce keyring_is_empty() Jarkko Sakkinen
2026-11-05 3:14 ` [PATCH v5 2/3] KEYS: Replace assoc_array with rhashtable Jarkko Sakkinen
2026-11-06 8:21 ` Hannes Reinecke
2026-11-06 9:05 ` Eric Biggers [this message]
2026-11-06 13:02 ` Hannes Reinecke
2026-11-06 19:05 ` Jarkko Sakkinen
2026-11-06 19:19 ` Eric Biggers
2026-11-06 19:30 ` Jarkko Sakkinen
2026-11-06 19:41 ` Jarkko Sakkinen
2026-11-08 20:05 ` David Laight
2026-11-06 15:08 ` Jarkko Sakkinen
2026-11-07 3:25 ` Eric Biggers
2026-11-07 12:44 ` Jarkko Sakkinen
2026-11-05 3:14 ` [PATCH v5 3/3] lib: Remove assoc_array Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261106090516.GA1973@sol \
--to=ebiggers@kernel.org \
--cc=agk@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=alexs@kernel.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bmarzins@redhat.com \
--cc=bpf@vger.kernel.org \
--cc=corbet@lwn.net \
--cc=daniel@iogearbox.net \
--cc=dhowells@redhat.com \
--cc=dm-devel@lists.linux.dev \
--cc=dzm91@hust.edu.cn \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=fsverity@lists.linux.dev \
--cc=hare@suse.de \
--cc=ihor.solodrai@linux.dev \
--cc=jarkko@kernel.org \
--cc=jmorris@namei.org \
--cc=jolsa@kernel.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=mpatocka@redhat.com \
--cc=paul@paul-moore.com \
--cc=rdunlap@infradead.org \
--cc=serge@hallyn.com \
--cc=si.yanteng@linux.dev \
--cc=skhan@linuxfoundation.org \
--cc=snitzer@kernel.org \
--cc=song@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.