netdev - Re: Does ESP support 64 bit sequence numbering for authentication hash ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4A9D1239.8000900@ixiacom.com>
Date:	Tue, 01 Sep 2009 15:23:21 +0300
From:	Alex Badea <abadea@...acom.com>
To:	Steffen Klassert <steffen.klassert@...unet.com>
CC:	Herbert Xu <herbert@...dor.apana.org.au>, djenkins@...sta.com,
	linux-crypto@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: Does ESP support 64 bit sequence numbering for authentication
 hash ?

On 09/01/2009 03:09 PM, Steffen Klassert wrote:
> On Thu, Jan 15, 2009 at 04:56:44PM +1100, Herbert Xu wrote:
>> Dean Jenkins <djenkins@...sta.com> wrote:
>>> Does ESP support 64 bit sequence numbering for use with the
>>> authentication HMAC ?
>> We don't support 64-bit sequence numbers yet.  If you look at
>> struct xfrm_replay_state which is where we store the sequence
>> number internally you'll find that it uses u32s.
>>
>> Patches for 64-bit support are welcome of course.
>>
> 
> Is there actually anybody working on 64-bit sequence number support?
> If not, I'd start to look at it.

A while ago I implemented a rough version of ESN support. It's against
an ancient 2.6.7 kernel though, and is only superficially tested.

I suppose there's no reason not to publish them here, if only for
historical reasons. My apologies to anyone not interested :)


Alex Badea (6):
      xfrm: move xfrm_replay_{check,advance} to their own source file
      xfrm: introduce XFRM_STATE_ESN flag, and extended replay structure
      xfrm: add generic support for replay protection with Extended
Sequence Numbers
      ipsec: Extended Sequence Numbers support for ESP
      ipsec: Extended Sequence Numbers support for AH
      xfrm: add test harness for Extended Sequence Numbers replay
protection algorithm


Best regards,
Alex

View attachment "0001-xfrm-move-xfrm_replay_-check-advance-to-their-own.patch" of type "text/x-diff" (3040 bytes)

View attachment "0002-xfrm-introduce-XFRM_STATE_ESN-flag-and-extended-re.patch" of type "text/x-diff" (921 bytes)

View attachment "0003-xfrm-add-generic-support-for-replay-protection-with.patch" of type "text/x-diff" (5534 bytes)

View attachment "0004-ipsec-Extended-Sequence-Numbers-support-for-ESP.patch" of type "text/x-diff" (5367 bytes)

View attachment "0005-ipsec-Extended-Sequence-Numbers-support-for-AH.patch" of type "text/x-diff" (4489 bytes)

View attachment "0006-xfrm-add-test-harness-for-Extended-Sequence-Numbers.patch" of type "text/x-diff" (7585 bytes)