Re: [PATCH] ima: remove buggy support for asynchronous hashes

[Mimi Zohar]

On Wed, 2026-03-11 at 22:39 -0700, Eric Biggers wrote:
> IMA computes hashes using the crypto_shash or crypto_ahash API.  The
> latter is used only when ima.ahash_minsize is set on the command line,
> and its purpose is ostensibly to make the hash computation faster.
> 
> However, going off the CPU to a crypto engine and back again is actually
> quite slow, especially compared with the acceleration that is built into
> modern CPUs and the kernel now enables by default for most algorithms.
> Typical performance results for SHA-256 on a modern platform can be
> found at https://lore.kernel.org/linux-crypto/20250615184638.GA1480@sol/
> 
> Partly for this reason, several other kernel subsystems have already
> dropped support for the crypto_ahash API.

The performance benefit was the ability of reading and filling a buffer from 
disk, which was slow, while the other buffer was sent to the crypto engine.

I'm all for removing extraneous code.  I'll give it a couple of days, before
queuing the patch in case there are any objections.

thanks,

Mimi