|WARNING| [v2,2/2] crypto/ipsec_mb: Add SHAKE support.

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/171071

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-12

# DPDK Patch Review

## Patch 1/2: crypto/ipsec_mb: Add SHA3 support

### ERRORS

None identified.

### WARNINGS

**Missing RTE_EXPORT_* macro for new public API:**
The patch adds new authentication algorithms (`RTE_CRYPTO_AUTH_SHA3_*`) to the public API capabilities,
but there are no corresponding `RTE_EXPORT_SYMBOL` or `RTE_EXPORT_EXPERIMENTAL_SYMBOL` annotations
visible in the code changes.
If these algorithms expose new public functions beyond the capability entries,
those functions must have export macros in their `.c` file definitions.

Note: If the new algorithms are only capability additions (no new exported functions),
this warning does not apply.

### INFO

**Array size increase:**
The `pads.inner` and `pads.outer` arrays in `struct aesni_mb_session` are increased from 128 to 144 bytes.
The comment is updated to reflect that SHA3-224 has the largest block size at 144 bytes.
This is consistent with the SHA3-224 block size of 144 bytes declared in the capabilities.

**Block size values:**
SHA3 block sizes in the capabilities and `auth_blocksize[]` array:
- SHA3-224: 144 bytes
- SHA3-256: 136 bytes
- SHA3-384: 104 bytes
- SHA3-512: 72 bytes

These match the SHA3 specification (1600-bit state with varying rate/capacity split).

---

## Patch 2/2: crypto/ipsec_mb: Add SHAKE support

### ERRORS

None identified.

### WARNINGS

**Missing RTE_EXPORT_* macro for new public API:**
Similar to patch 1/2, if the new SHAKE algorithms expose public functions beyond capability entries,
those functions must have `RTE_EXPORT_*` annotations.

**SHAKE digest size limits:**
The SHAKE capabilities declare:
```c
.digest_size = {
    .min = 1,
    .max = 65535,
    .increment = 1
}
```

SHAKE is an extendable-output function (XOF) that can produce arbitrary-length output.
However, declaring `max = 65535` may be misleading or overly permissive if the implementation
has practical limits (e.g., buffer size constraints, performance considerations).
Verify that the underlying Intel IPsec-MB library truly supports SHAKE output lengths up to 65535 bytes,
and that the PMD can allocate and handle such digest buffers.

**SHAKE truncated digest lengths:**
```c
[IMB_AUTH_SHAKE128] = 64,
[IMB_AUTH_SHAKE256] = 64
```

The `auth_truncated_digest_byte_lengths[]` array sets SHAKE-128 and SHAKE-256 truncated lengths to 64 bytes.
For SHAKE-128, NIST SP 800-185 recommends a minimum output length of 256 bits (32 bytes) for 128-bit security,
not 64 bytes.
Similarly, SHAKE-256 should produce at least 512 bits (64 bytes) for 256-bit security.

Setting both to 64 bytes may be intentional for consistency,
but it means SHAKE-128 is producing double the minimum recommended output.
Confirm this matches the intended security level and Intel IPsec-MB behavior.

### INFO

**SHAKE block sizes:**
```c
[IMB_AUTH_SHAKE128] = 168,
[IMB_AUTH_SHAKE256] = 136
```

These match the SHAKE specifications:
- SHAKE-128: rate = 1344 bits = 168 bytes
- SHAKE-256: rate = 1088 bits = 136 bytes

**Digest byte lengths:**
Both `auth_digest_byte_lengths[]` entries set SHAKE output to 64 bytes,
consistent with `auth_truncated_digest_byte_lengths[]`.

---

## Overall Assessment

Both patches correctly add SHA3 and SHAKE algorithm support to the IPsec-MB PMD
with appropriate version gating (`#if IMB_VERSION(3, 0, 0) <= IMB_VERSION_NUM`).

The documentation updates in `aesni_mb.rst`, `features/aesni_mb.ini`,
and `release_26_11.rst` are present and match the code changes.

No correctness bugs (resource leaks, use-after-free, race conditions) were identified.

The primary concerns are:
1. Verification that new public API functions (if any) have `RTE_EXPORT_*` macros
2. Confirmation that SHAKE digest size limits match implementation capabilities
3. Validation that SHAKE truncated digest lengths meet security requirements

Review-Result: WARNING