Re: [PATCH net-next 3/5] net/rxrpc: Reimplement DES-PCBC using DES library

[Eric Biggers <ebiggers@kernel.org>]

On Fri, Oct 30, 2026 at 04:53:36AM +0000, sashiko-bot@kernel.org wrote:
> Does this introduce an unintended behavior change regarding weak DES keys?
> 
> The old code used crypto_skcipher_setkey(), which in the generic DES
> implementation suppresses the -ENOKEY error and returns 0 (success) unless
> CRYPTO_TFM_REQ_FORBID_WEAK_KEYS is explicitly set. The RxRPC code did not
> set this flag, meaning weak DES keys were silently accepted.
> 
> By calling des_expand_key() directly, which unconditionally returns -ENOKEY
> for weak keys, rxkad_preparse_server_key() will now fail and reject these
> keys instead of succeeding. 
> 
> While weak keys shouldn't be used, could this undocumented change break
> backward compatibility for existing userspace configurations or test
> environments relying on fixed weak keys?

Could be either a bug or a feature.  If someone wants to make
net/rxrpc/rxkad.c start allowing weak DES keys again (by ignoring
-ENOKEY from des_expand_key()), it could be done.  I doubt anyone cares.

- Eric