From: "Jason A. Donenfeld" Subject: Re: [kernel-hardening] Re: [PATCH v5 1/4] siphash: add cryptographically secure PRF Date: Fri, 16 Dec 2016 22:09:14 +0100 Message-ID: References: <20161216034618.28276.qmail@ns.sciencehorizons.net> <1481921067.1054.6.camel@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Cc: kernel-hardening@lists.openwall.com, Jean-Philippe Aumasson , George Spelvin , Andi Kleen , David Miller , David Laight , Eric Biggers , Hannes Frederic Sowa , Linux Crypto Mailing List , LKML , Andy Lutomirski , Netdev , Linus Torvalds , "Theodore Ts'o" , Vegard Nossum , "Daniel J . Bernstein" To: Daniel Micay Return-path: Received: from frisell.zx2c4.com ([192.95.5.64]:48307 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755071AbcLPVJT (ORCPT ); Fri, 16 Dec 2016 16:09:19 -0500 In-Reply-To: <1481921067.1054.6.camel@gmail.com> Sender: linux-crypto-owner@vger.kernel.org List-ID: Hi Daniel, On Fri, Dec 16, 2016 at 9:44 PM, Daniel Micay wrote: > On Fri, 2016-12-16 at 11:47 -0800, Tom Herbert wrote: >> >> That's about 3x of jhash speed (7 nsecs). So that might closer >> to a more palatable replacement for jhash. Do we lose any security >> advantages with halfsiphash? > > Have you tested a lower round SipHash? Probably best to stick with the > usual construction for non-DoS mitigation, but why not try SipHash 1-3, > 1-2, etc. for DoS mitigation? > > Rust and Swift both went with SipHash 1-3 for hash tables. Maybe not a bad idea. SipHash2-4 for MD5 replacement, as we've done so far. This is when we actually want things to be secure (and fast). And then HalfSipHash1-3 for certain jhash replacements. This is for when we're talking only about DoS or sort of just joking about security, and want things to be very competitive with jhash. (Of course for 64-bit we'd use SipHash1-3 instead of HalfSipHash for the speedup.) I need to think on this a bit more, but preliminarily, I guess this would be maybe okay... George, JP - what do you think? Jason