Re: [PATCH] CMAC support for CryptoAPI, fixed patch issues, indent, and testmgr build issues

Quoting Tom St Denis [off-list ref]:

----- Original Message -----

quoted

From: "Jussi Kivilinna" <redacted>
To: "Tom St Denis" <redacted>
Cc: linux-kernel@vger.kernel.org, "Herbert Xu"  
[off-list ref], "David Miller" [off-list ref],
linux-crypto@vger.kernel.org, "Steffen Klassert"  
[off-list ref], netdev@vger.kernel.org
Sent: Wednesday, 23 January, 2013 9:36:44 AM
Subject: Re: [PATCH] CMAC support for CryptoAPI, fixed patch  
issues, indent, and testmgr build issues

Quoting Tom St Denis [off-list ref]:

quoted

Hey all,

Here's an updated patch which addresses a couple of build issues
and
coding style complaints.

I still can't get it to run via testmgr I get

[  162.407807] alg: No test for cmac(aes) (cmac(aes-generic))

Despite the fact I have an entry for cmac(aes) (much like
xcbc(aes)...).

Here's the patch to bring 3.8-rc4 up with CMAC ...

Signed-off-by: Tom St Denis <redacted>

<snip>

quoted

diff --git a/include/uapi/linux/pfkeyv2.h

b/include/uapi/linux/pfkeyv2.h
index 0b80c80..d61898e 100644

--- a/include/uapi/linux/pfkeyv2.h
+++ b/include/uapi/linux/pfkeyv2.h

@@ -296,6 +296,7 @@ struct sadb_x_kmaddress {
 #define SADB_X_AALG_SHA2_512HMAC	7
 #define SADB_X_AALG_RIPEMD160HMAC	8
 #define SADB_X_AALG_AES_XCBC_MAC	9
+#define SADB_X_AALG_AES_CMAC_MAC	10
 #define SADB_X_AALG_NULL		251	/* kame */
 #define SADB_AALG_MAX			251

Should these values be based on IANA assigned IPSEC AH transform
identifiers?

https://www.iana.org/assignments/isakmp-registry/isakmp-registry.xml#isakmp-registry-6

There is no CMAC entry apparently ... despite the fact that CMAC is  
a proposed RFC standard for IPsec.

It might be safer to move that to 14 since it's currently unassigned  
and then go through whatever channels are required to allocate it.   
Mostly this affects key setting.  So this means my patch would break  
AH_RSA setkey calls (which the kernel doesn't support anyways).

Problem seems to be that PFKEYv2 does not quite work with IKEv2, and  
XFRM API should be used instead. There is new numbers assigned for  
IKEv2:  
https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xml#ikev2-parameters-7

For new SADB_X_AALG_*, I'd think you should use value from "Reserved  
for private use" range. Maybe 250?

But maybe better solution might be to not make AES-CMAC (or other new  
algorithms) available throught PFKEY API at all, just XFRM?

-Jussi