linux-kernel - Re: [PATCH v2 3/4] nvme: Expose the tls_configured sysfs for secure concat connections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKmqyKNzi7OAq49b-aa1H8++ReTvWnHKBDwA88ionJshhOVp9g@mail.gmail.com>
Date: Thu, 13 Nov 2025 12:08:14 +1000
From: Alistair Francis <alistair23@...il.com>
To: Hannes Reinecke <hare@...e.de>
Cc: kbusch@...nel.org, axboe@...nel.dk, hch@....de, sagi@...mberg.me, 
	kch@...dia.com, linux-nvme@...ts.infradead.org, linux-kernel@...r.kernel.org, 
	Alistair Francis <alistair.francis@....com>
Subject: Re: [PATCH v2 3/4] nvme: Expose the tls_configured sysfs for secure
 concat connections

On Wed, Nov 12, 2025 at 5:08 PM Hannes Reinecke <hare@...e.de> wrote:
>
> On 11/12/25 00:45, alistair23@...il.com wrote:
> > From: Alistair Francis <alistair.francis@....com>
> >
> > Signed-off-by: Alistair Francis <alistair.francis@....com>
> > ---
> > v2:
> >   - New patch
> >
> >   drivers/nvme/host/sysfs.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
> > index 29430949ce2f..6d10e12136d0 100644
> > --- a/drivers/nvme/host/sysfs.c
> > +++ b/drivers/nvme/host/sysfs.c
> > @@ -838,7 +838,7 @@ static umode_t nvme_tls_attrs_are_visible(struct kobject *kobj,
> >           !ctrl->opts->tls && !ctrl->opts->concat)
> >               return 0;
> >       if (a == &dev_attr_tls_configured_key.attr &&
> > -         (!ctrl->opts->tls_key || ctrl->opts->concat))
> > +         !ctrl->opts->concat)
> >               return 0;
> >       if (a == &dev_attr_tls_keyring.attr &&
> >           !ctrl->opts->keyring)
>
> ??
>
> How can you have a configured TLS Key for secure concatenation?

I'm not sure I follow

`ctrl->opts->tls_key` is directly set at the end of the
`nvme_auth_secure_concat()` function, so it will be set for secure
concatenation.

> We generate the keys from the DH-CHAP key material, don't we?

I haven't checked that closely, but the key seems to be generated from
the CHAP hash id

Alistair

>
> Cheers,
>
> Hannes
> --
> Dr. Hannes Reinecke                  Kernel Storage Architect
> hare@...e.de                                +49 911 74053 688
> SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
> HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich