Thanks for the suggestions. I hope this patch update addresses all the issues.

Simplified patch, using u_int as suggested.

Updated the patch to use 32 bit sized counter and atomic(9) methods.

I think you're correct. Also adding the #ifdef looks a little ugly to me, and I'd be happy to avoid that.

THanks for the feedback!

I finally tested this and works fine for me.

Added kp and Reid Linnemann to subscribers since the patch touches on their recent commit, so they can make sure I'm not braking it.

Fix patch after commit 9e792f7ef7298080c058fbc2d36a4e60e596dae9

Looks like commit 9e792f7ef7298080c058fbc2d36a4e60e596dae9 causes a conflict in this patch. I'm adjusting my changes, will post a new patch soon.

I've added HMAC, it was easier than I thought, actually. I based my work on the Wikipedia description and some code borrowed from sys/geom/eli/g_eli_hmac.c. I did not bother with clearing the keys used since the source material is not really high security secrets in this case. I noticed SHA256_Final already zeroes the context value, so I decided to reuse it.

I will try to provide an update as fast as I can, but being away from home it could take just a little more than a week to have something ready.