netdev - Re: [RFC 2/2] TCP: Add TCP-AO support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 19 Jul 2008 10:06:48 +0900 (JST)
From:	YOSHIFUJI Hideaki / 吉藤英明 
	<yoshfuji@...ux-ipv6.org>
To:	agl@...erialviolet.org
Cc:	netdev@...r.kernel.org, yoshfuji@...ux-ipv6.org
Subject: Re: [RFC 2/2] TCP: Add TCP-AO support

Hello

>   * Only two keys supported (against a spec max of 256)

Do we have to manage all key at the same time?
I don't think so.

If yes...

In article <396556a20805301217k293e5718h6bbf02bfe069032@...opa> (at Fri, 18 Jul 2008 17:22:10 -0700), "Adam Langley" <agl@...erialviolet.org> says:

> /* tcpa_flags */
> #define TCP_AUTH_ALLOW_KEY0		(1 << 0)
> #define TCP_AUTH_ALLOW_KEY1		(1 << 1)
> #define TCP_AUTH_TX_KEY1		(1 << 2)
> #define TCP_AUTH_RFC2385		(1 << 3)
> #define TCP_AUTH_OPTIONS_EXCLUDE	(1 << 4)
> #define TCP_AUTH_PSEUDOHEADER_EXCLUDE	(1 << 5)
> #define TCP_AUTH_PORT_NUMS_EXCLUDE	(1 << 6)
> #define TCP_AUTH_LATCH			(1 << 7)
> 
> struct tcp_auth {
> 	struct __kernel_sockaddr_storage tcpa_addr;	/* address associated */
> 	__u8	tcpa_key0[TCP_AUTH_MAXKEYLEN];		/* key0 (binary) */
> 	__u8	tcpa_key1[TCP_AUTH_MAXKEYLEN];		/* key1 (binary) */
> 	__u8	tcpa_key0len;				/* key0 length */
> 	__u8	tcpa_key1len;				/* key1 length */
> 	__u8	tcpa_macfunc;				/* MAC function */
> 	__u8	tcpa_flags;
> };

I think flags and number of keys should be extendable.
How about this?

struct tcp_auth {
      struct __kernel_sockaddr_storage tcpa_addr;
      __u32   tcpa_flags;
      __u8    tcpa_macfunc;
      __u8    tcpa_reserved;
      __u16   tcpa_txkey;
      __u8    tcpa_keylen[256];
      __u8    tcpa_key[TCP_AUTH_MAXKEYLEN];
      /* other keys follow */
};

--yoshfuji
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html