netdev - Re: [PATCH net-next 0/4] kernel TLS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 25 May 2017 13:29:32 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     davejwatson@...com
Cc:     ilyal@...lanox.com, aviadye@...lanox.com, borisp@...lanox.com,
        liranl@...lanox.com, matanb@...lanox.com, netdev@...r.kernel.org,
        tom@...bertland.com, herbert@...dor.apana.org.au,
        linux-crypto@...r.kernel.org, hannes@...essinduktion.org,
        alexei.starovoitov@...il.com, nmav@...lts.org,
        fridolin.pokorny@...il.com
Subject: Re: [PATCH net-next 0/4] kernel TLS

From: Dave Watson <davejwatson@...com>
Date: Wed, 24 May 2017 09:26:33 -0700

> This series adds support for kernel TLS encryption over TCP sockets.
> A standard TCP socket is converted to a TLS socket using a setsockopt.
> Only symmetric crypto is done in the kernel, as well as TLS record
> framing.  The handshake remains in userspace, and the negotiated
> cipher keys/iv are provided to the TCP socket.
> 
> We implemented support for this API in OpenSSL 1.1.0, the code is
> available at https://github.com/Mellanox/tls-openssl/tree/master
> 
> It should work with any TLS library with similar modifications,
> a test tool using gnutls is here: https://github.com/Mellanox/tls-af_ktls_tool
> 
> Changes from RFC V2:
> 
> * Generic ULP (upper layer protocol) framework instead of TLS specific
>   setsockopts
> * Dropped Mellanox hardware patches, will come as separate series.
>   Framework will work for both.

The value in this is seeing how it can work transparently behind
an existing userspace library providing TLS services.

So the reference to the gnutls and openssl implementations probably
belongs in the Documentation patch #4 too.

Thanks.