Re: [PATCH] net-xfrm: add build time cfg option to PF_KEY SHA256 to use RFC4868-compliant truncation

Maciej Żenczykowski [off-list ref] wrote:

+#if IS_ENABLED(CONFIG_XFRM_HMAC_SHA256_RFC4868)
+                       .icv_truncbits = 128,
+#else
                       .icv_truncbits = 96,
+#endif

Nack.  We don't want a build-time configuration knob for this.
This needs to be decided at run-time.

In fact you can already do this at run-time anyway through the
xfrm interface.  So please please please just ditch whatever that
you're using that's still glued to the long-obsolete (more than a
decade) af_key interface and switch it over to xfrm.

Thanks,
-- 
Email: Herbert Xu [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt