From: Michael Richardson <mcr@sandelman.ca>
To: linux-crypto@vger.kernel.org
Subject: Re: SHA-2 HMAC support in linux kernel
Date: Mon, 02 Apr 2007 19:04:59 -0400 [thread overview]
Message-ID: <eus26s$8ji$1@sea.gmane.org> (raw)
In-Reply-To: <45FB116C.5080205@certicom.com>
Chinh Nguyen wrote:
> Looking at the source http://lxr.linux.no/source/net/xfrm/xfrm_algo.c,
> it seems to confirm that this is true. In fact, sha-384 and sha-512 are
> not supported at this time and sha-256 is truncated to 96-bit.
That's normal.
HMAC usage in IPsec specifies that we only use 96-bits of the result.
This is a tradeoff in space in the packet vs absolute "security"
In addition should you be able to cause a collision in 96-bits by some
method other than brute force, you can not be sure if you guess the key
properly.
> However, the following ietf draft, which I believe is very closed to
> ratification (it has already been assigned iana numbers), specifies
> sha-256 to use 128-bits as hmac (page 18):
> http://www.ietf.org/internet-drafts/draft-kelly-ipsec-ciph-sha2-01.txt
Yes, but that's the key, not the result.
It is keyed with various sizes of bits, but the results are truncated.
next prev parent reply other threads:[~2007-04-02 23:05 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-03-16 21:51 SHA-2 HMAC support in linux kernel Chinh Nguyen
2007-04-02 23:04 ` Michael Richardson [this message]
-- strict thread matches above, loose matches on Subject: below --
2007-03-16 19:50 Using libnetfilter_queue Rennie deGraaf
2007-03-16 21:25 ` SHA-2 HMAC support in linux kernel Chinh Nguyen
2007-03-16 20:31 ` YOSHIFUJI Hideaki / 吉藤英明
2007-03-16 20:32 ` Jan Engelhardt
2007-03-16 21:42 ` Chinh Nguyen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='eus26s$8ji$1@sea.gmane.org' \
--to=mcr@sandelman.ca \
--cc=linux-crypto@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.