On Mon, Mar 16, 2009 at 12:52:51PM +0100, Steffen Klassert wrote: > If the crypro requests of a crypto transformation are processed in > parallel, the usual chain IV generator would serialize the crypto > requests again. The percpu IV chain genarator allocates the IV as > percpu data and generates percpu IV chains, so a crypro request > does not need to wait for the completition of the IV generation > from a previous request that runs on a different cpu. > > Signed-off-by: Steffen Klassert <steffen.klassert@xxxxxxxxxxx> I actually thought about this one when I first wrote chainiv, I chose to avoid this because it has some security consequences. In particular, an attacker would now be able to infer whether two packets belong to two differnt flows from the fact that they came from two different IV streams. In any case, I don't think this is central to your work, right? Thanks, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
