Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Date:   Mon, 21 Mar 2022 22:55:45 -0700
From:   Eric Biggers <ebiggers@kernel.org>
To:     Nathan Huckleberry <nhuck@google.com>
Cc:     linux-crypto@vger.kernel.org,
        Herbert Xu <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>,
        linux-arm-kernel@lists.infradead.org,
        Paul Crowley <paulcrowley@google.com>,
        Sami Tolvanen <samitolvanen@google.com>,
        Ard Biesheuvel <ardb@kernel.org>
Subject: Re: [PATCH v3 2/8] crypto: polyval - Add POLYVAL support
Message-ID: <Yjlk4WHNZqFSSY/n@sol.localdomain>
References: <20220315230035.3792663-1-nhuck@google.com>
 <20220315230035.3792663-3-nhuck@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20220315230035.3792663-3-nhuck@google.com>
Precedence: bulk

On Tue, Mar 15, 2022 at 11:00:29PM +0000, Nathan Huckleberry wrote:
> Add support for POLYVAL, an ε-Δ-universal hash function similar to
> GHASH.  POLYVAL is used as a component to implement HCTR2 mode.
> 
> POLYVAL is implemented as an shash algorithm.  The implementation is
> modified from ghash-generic.c.
> 
> More information on POLYVAL can be found in the HCTR2 paper:
> https://eprint.iacr.org/2021/1441.pdf
> 
> Signed-off-by: Nathan Huckleberry <nhuck@google.com>

Generally looks good, feel free to add:

	Reviewed-by: Eric Biggers <ebiggers@google.com>

But, I think you should mention that POLYVAL is originally from AES-GCM-SIV (RFC
8452).  It's true that the kernel doesn't implement AES-GCM-SIV currently, but
it's still important to mention.  Both the commit message and comment in
crypto/polyval-generic.c should mention this, IMO.  As-is, the only hint of this
in this patch is the comment above the test vectors.

Your explanation about how POLYVAL can be implemented on top of GHASH is also a
bit incomplete.  Linking to
https://datatracker.ietf.org/doc/html/rfc8452#appendix-A would be helpful.

- Eric