On Tue, Mar 15, 2022 at 11:00:29PM +0000, Nathan Huckleberry wrote: > Add support for POLYVAL, an ε-Δ-universal hash function similar to > GHASH. POLYVAL is used as a component to implement HCTR2 mode. > > POLYVAL is implemented as an shash algorithm. The implementation is > modified from ghash-generic.c. > > More information on POLYVAL can be found in the HCTR2 paper: > https://eprint.iacr.org/2021/1441.pdf > > Signed-off-by: Nathan Huckleberry <nhuck@xxxxxxxxxx> Generally looks good, feel free to add: Reviewed-by: Eric Biggers <ebiggers@xxxxxxxxxx> But, I think you should mention that POLYVAL is originally from AES-GCM-SIV (RFC 8452). It's true that the kernel doesn't implement AES-GCM-SIV currently, but it's still important to mention. Both the commit message and comment in crypto/polyval-generic.c should mention this, IMO. As-is, the only hint of this in this patch is the comment above the test vectors. Your explanation about how POLYVAL can be implemented on top of GHASH is also a bit incomplete. Linking to https://datatracker.ietf.org/doc/html/rfc8452#appendix-A would be helpful. - Eric