linux-kernel - Re: [PATCH v2 1/2] nvme-auth: use transformed key size to create resp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4fb894c2-653b-48c7-be48-5eeb3978063c@suse.de>
Date:   Mon, 16 Oct 2023 11:14:38 +0200
From:   Hannes Reinecke <hare@...e.de>
To:     Mark O'Donovan <shiftee@...teo.net>, linux-kernel@...r.kernel.org
Cc:     linux-nvme@...ts.infradead.org, sagi@...mberg.me, hch@....de,
        axboe@...nel.dk, kbusch@...nel.org,
        Akash Appaiah <Akash.Appaiah@...l.com>
Subject: Re: [PATCH v2 1/2] nvme-auth: use transformed key size to create resp

On 10/16/23 10:57, Mark O'Donovan wrote:
> This does not change current behaviour as the driver currently
> verifies that the secret size is the same size as the length of
> the transformation hash.
> 
> Co-developed-by: Akash Appaiah <Akash.Appaiah@...l.com>
> Signed-off-by: Akash Appaiah <Akash.Appaiah@...l.com>
> Signed-off-by: Mark O'Donovan <shiftee@...teo.net>
> ---
> V1 -> V2: support target implementation and controller secrets also
> 
>   drivers/nvme/common/auth.c | 6 +++++-
>   drivers/nvme/host/auth.c   | 4 ++--
>   drivers/nvme/target/auth.c | 4 ++--
>   include/linux/nvme-auth.h  | 3 ++-
>   4 files changed, 11 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/nvme/common/auth.c b/drivers/nvme/common/auth.c
> index d90e4f0c08b7..26a7fbdf4d55 100644
> --- a/drivers/nvme/common/auth.c
> +++ b/drivers/nvme/common/auth.c
> @@ -243,6 +243,8 @@ u8 *nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn)
>   	}
>   	if (key->hash == 0) {
>   		transformed_key = kmemdup(key->key, key->len, GFP_KERNEL);
> +		if (transformed_key)
> +			key->transformed_len = key->len;
>   		return transformed_key ? transformed_key : ERR_PTR(-ENOMEM);

Hmm. But now we're inconsistent.
The input structure 'key' doesn't know (nor does care) if the key has 
been transformed; the transformation itself is returned in a different 
structure.

If we were to go that way the it'll be better to return a 'struct 
nvme_dhchap_key' from nvme_auth_transform_key(), which will then 
encapsulate the data and the correct length.

Which probably is not a bad idea, seeing that a key transform really 
should generate a new key.

Hmm?

Cheers,

Hannes
-- 
Dr. Hannes Reinecke		           Kernel Storage Architect
hare@...e.de			                  +49 911 74053 688
SUSE Software Solutions Germany GmbH, Frankenstr. 146, 90461 Nürnberg
Managing Directors: I. Totev, A. Myers, A. McDonald, M. B. Moerman
(HRB 36809, AG Nürnberg)