On Wed, Jul 29, 2015 at 5:40 PM, John-Mark Gurney <j...@funkthat.com> wrote:
> Ermal Lui wrote this message on Wed, Jul 29, 2015 at 14:53 +0200: > > this was forgotten part on my patches merge from gnn@. > > Can it be fixed by correcting the patches rather than re-introducing > this? > > > > Most probably the constant definition is wrong on the transforms and also > > some part of code removal was missed. > > No, it cannot be fixed by changing opencrypto/xform.c to truncate the > hash size... The reason it cannot be is that OCF is not an IPsec only > framework... > > Geli also uses the HMAC constructions, and I have not confirmed if they > use the full hash size or not... I would be open to adding a field to > the crypto descriptor that limited how much of the hash is copied out... > > It would have been helpful to comment more of these changes... If you > make a change for a reason (RFC, etc), then throw that in the comments, > which allows someone following to understand why and prevent their > removal... At least if they were commented as to why they changed, we > would have known to rework the change... > > Yes you are right but according to me this is standard practice being done allover SSL/IPSec.... I am not sure which standard GELI follows to comment on that! Also then it would be better to review the declarations on the transform since they are apparently not generic, no? > > On Wed, Jul 29, 2015 at 9:15 AM, John-Mark Gurney <j...@freebsd.org> > wrote: > > > > > Author: jmg > > > Date: Wed Jul 29 07:15:16 2015 > > > New Revision: 286000 > > > URL: https://svnweb.freebsd.org/changeset/base/286000 > > > > > > Log: > > > RFC4868 section 2.3 requires that the output be half... This fixes > > > problems that was introduced in r285336... I have verified that > > > HMAC-SHA2-256 both ah only and w/ AES-CBC interoperate w/ a NetBSD > > > 6.1.5 vm... > > > > > > Reviewed by: gnn > > -- > John-Mark Gurney Voice: +1 415 225 5579 > > "All that I will do, has been done, All that I have, has not." > -- Ermal _______________________________________________ svn-src-all@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
