Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH 5/5] crypto: remove Salsa20 stream cipher algorithm
To:     Ard Biesheuvel <ardb@kernel.org>,
        Eric Biggers <ebiggers@kernel.org>, agk@redhat.com,
        Mike Snitzer <snitzer@redhat.com>, dm-devel@redhat.com,
        Mikulas Patocka <mpatocka@redhat.com>
Cc:     Linux Crypto Mailing List <linux-crypto@vger.kernel.org>,
        Herbert Xu <herbert@gondor.apana.org.au>
References: <20210121130733.1649-1-ardb@kernel.org>
 <20210121130733.1649-6-ardb@kernel.org> <YAnCbnnFCQkyBpUA@sol.localdomain>
 <CAMj1kXEycOHSMQu2T1tdQrmapk+g0oQFDiWXDo0J0BKg4QgEuQ@mail.gmail.com>
From:   Milan Broz <gmazyland@gmail.com>
Message-ID: <2f010ae0-b949-d9b8-c382-e02447b36166@gmail.com>
Date:   Thu, 21 Jan 2021 19:23:14 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.6.1
MIME-Version: 1.0
In-Reply-To: <CAMj1kXEycOHSMQu2T1tdQrmapk+g0oQFDiWXDo0J0BKg4QgEuQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 21/01/2021 19:09, Ard Biesheuvel wrote:
> On Thu, 21 Jan 2021 at 19:05, Eric Biggers <ebiggers@kernel.org> wrote:
>>
>> On Thu, Jan 21, 2021 at 02:07:33PM +0100, Ard Biesheuvel wrote:
>>> Salsa20 is not used anywhere in the kernel, is not suitable for disk
>>> encryption, and widely considered to have been superseded by ChaCha20.
>>> So let's remove it.
>>>
>>> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
>>> ---
>>>  Documentation/admin-guide/device-mapper/dm-integrity.rst |    4 +-
>>>  crypto/Kconfig                                           |   12 -
>>>  crypto/Makefile                                          |    1 -
>>>  crypto/salsa20_generic.c                                 |  212 ----
>>>  crypto/tcrypt.c                                          |   11 +-
>>>  crypto/testmgr.c                                         |    6 -
>>>  crypto/testmgr.h                                         | 1162 --------------------
>>>  7 files changed, 3 insertions(+), 1405 deletions(-)
>>>
>>> diff --git a/Documentation/admin-guide/device-mapper/dm-integrity.rst b/Documentation/admin-guide/device-mapper/dm-integrity.rst
>>> index 4e6f504474ac..d56112e2e354 100644
>>> --- a/Documentation/admin-guide/device-mapper/dm-integrity.rst
>>> +++ b/Documentation/admin-guide/device-mapper/dm-integrity.rst
>>> @@ -143,8 +143,8 @@ recalculate
>>>  journal_crypt:algorithm(:key)        (the key is optional)
>>>       Encrypt the journal using given algorithm to make sure that the
>>>       attacker can't read the journal. You can use a block cipher here
>>> -     (such as "cbc(aes)") or a stream cipher (for example "chacha20",
>>> -     "salsa20" or "ctr(aes)").
>>> +     (such as "cbc(aes)") or a stream cipher (for example "chacha20"
>>> +     or "ctr(aes)").
>>
>> You should check with the dm-integrity maintainers how likely it is that people
>> are using salsa20 with dm-integrity.  It's possible that people are using it,
>> especially since the documentation says that dm-integrity can use a stream
>> cipher and specifically gives salsa20 as an example.
>>
> 
> Good point - cc'ed them now.

I would say - just remove it. I do not see any users, we do not even test this combination in userspace testsuite.
It is just an example in doc.

From my POV these stream crypto ciphers should be never used there (but cc to Mikulas, it was his patch :-)

Milan