On Tue, May 26, 2020 at 12:44:28PM +0000, Johannes Thumshirn wrote: > On 26/05/2020 13:54, David Sterba wrote: > > On Tue, May 26, 2020 at 07:50:53AM +0000, Johannes Thumshirn wrote: > >> On 25/05/2020 15:11, David Sterba wrote: > >>> I'd outright skip crc32c for the checksum so we have only small number > >>> of authenticated checksums and avoid too many options, eg. > >>> hmac-sha256-crc32c etc. The result will be still 2 authenticated hashes > >>> with the added checksum hardcoded to xxhash. > >> > >> Hmm I'm really not a fan of this. We would have to use something like > >> sha2-224 to get the room for the 2nd checksum. So we're using a weaker > >> hash just so we can add a second checksum. > > > > The idea is to calculate full hash (32 bytes) and store only the part > > (24 bytes). Yes this means there's some information loss and weakening, > > but enables a usecase. > > I'm not enough a security expert to be able to judge this. Eric can I hear > your opinion on this? Given that this has implications on strength and the usecases, I'd rather let the filesystem provide the options and let the user choose and not make the decision for their behalf. This would increase number of authenticated hashes to 4 in the end: 1. authenticated with 32byte/256bit hash (sha256, blake2b) + full strength - no way to verify checksums without the key 2. authenticated with 24bytes/192bit hash (sha256, blake2b) where the last 8 bytes are xxhash64 ~ weakened strength but should be still sufficient + possibility to verify checksums without the key - slight perf cost for the 2nd hash As option 2 needs some evaluation and reasoning whether it does not compromise the security, I don't insist on having it implemented in the first phase. I have a prototype code for that so it might live in linux-next for some time before we'd merge it. Regarding backward compatibility, the checksums are easy compared to other features. The supported status can be deteremined directly from superblock so adding new types of checksum do not require compat bits and the code for that.
