Re: [PATCH] crypto: aead: add service indicator flag for RFC4106 AES-GCM

[Jeff Barnes <jeffbarnes@linux.microsoft.com>]

On 3/2/26 07:26, Herbert Xu wrote:
> On Sun, Mar 01, 2026 at 02:41:28PM -0600, Joachim Vandersmissen wrote:
>> However, Cryptographic Module Validation Program has also recently made it
>> clear that xxhash64 cannot be FIPS approved the way it is currently
>> implemented in the kernel. Even though the designers of xxhash publicly
>> state that it is a non-cryptographic hash, the kernel offers it as part of
>> the shash interface, the same interface as the approved algorithms. The
>> interface / API also has "crypto" in the name, which according to CMVP
>> implies security. CMVP feels that there could be confusion with the approved
>> hash algorithms, so there needs to be some indication that xxhash64 is not
>> FIPS approved. I think blocking xxhash64 in FIPS mode would break btrfs,
>> where it is used for checksumming.
> xxhash64 should be converted to lib/crypto and removed from the
> Crypto API.
>
> Thanks,


I believe Eric Biggers commitfe11ac191ce0ad910f6fda0c628bcff19fcff47d 
did this already.
Best,
Jeff