On Fri, Nov 06, 2026 at 09:30:45PM +0200, Jarkko Sakkinen wrote: > > SipHash is also useful for resistance against denial-of-service attacks, > > where a user puts all their keys in one hash bucket. > > > > As I mentioned, it's already used for secure hash tables elsewhere in > > the kernel. That is what it's for; see > > Documentation/security/siphash.rst. It's very fast as well, so if you > > are thinking of cryptography as being something very slow and hard to > > use, that is not what this is (or ever needed to be). > > > > Let's just use it and not over-complicate things. > > I'm pretty much non-opionated when it comes to this detail. I just > merely represent all the possible if anything comes up to mind. DoS > protection that you explained was not something I did even consider so > that seals it for me.
I'm cutting hairs now but indices + siphash adds to defence in depth as it only takes DoS protection from SipHash while not protecting a secret. Not sure if this has that much pratical meaning tho :-) Br, Jarkko
