[PATCH v3 2/8] crypto: polyval - Add POLYVAL support

[Eric Biggers]

On Tue, Mar 15, 2022 at 11:00:29PM +0000, Nathan Huckleberry wrote:
> Add support for POLYVAL, an ε-Δ-universal hash function similar to
> GHASH.  POLYVAL is used as a component to implement HCTR2 mode.
> 
> POLYVAL is implemented as an shash algorithm.  The implementation is
> modified from ghash-generic.c.
> 
> More information on POLYVAL can be found in the HCTR2 paper:
> https://eprint.iacr.org/2021/1441.pdf
> 
> Signed-off-by: Nathan Huckleberry <nhuck at google.com>

Generally looks good, feel free to add:

	Reviewed-by: Eric Biggers <ebiggers at google.com>

But, I think you should mention that POLYVAL is originally from AES-GCM-SIV (RFC
8452).  It's true that the kernel doesn't implement AES-GCM-SIV currently, but
it's still important to mention.  Both the commit message and comment in
crypto/polyval-generic.c should mention this, IMO.  As-is, the only hint of this
in this patch is the comment above the test vectors.

Your explanation about how POLYVAL can be implemented on top of GHASH is also a
bit incomplete.  Linking to
https://datatracker.ietf.org/doc/html/rfc8452#appendix-A would be helpful.

- Eric