lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <b2079e8c46815eedf40987e3c967e356242e3c52.camel@redhat.com>
Date:   Wed, 25 Jan 2023 18:05:38 -0500
From:   Simo Sorce <simo@...hat.com>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     Apoorv Kothari <apoorvko@...zon.com>, sd@...asysnail.net,
        borisp@...dia.com, dueno@...hat.com, fkrenzel@...hat.com,
        gal@...dia.com, netdev@...r.kernel.org, tariqt@...dia.com
Subject: Re: [PATCH net-next 0/5] tls: implement key updates for TLS1.3

On Wed, 2023-01-25 at 14:43 -0800, Jakub Kicinski wrote:
> On Wed, 25 Jan 2023 16:17:26 -0500 Simo Sorce wrote:
> > > We're talking about the Tx direction, the packets are queued to the
> > > lower layers of the stack unencrypted, and get encrypted by the NIC.
> > > Until TCP gets acks for all the data awaiting offloaded crypto - we
> > > must hold onto the keys.  
> > 
> > Is this because the NIC does not cache the already encrypted outgoing
> > packets?
> 
> NIC can't cache outgoing packets, there's too many and NIC is supposed
> to only do crypto. TCP stack is responsible for handing rtx.
> 
> > If that is the case is it _guaranteed_ that the re-encrypted packets
> > are exactly identical to the previously sent ones?
> 
> In terms of payload, yes. Modulo zero-copy cases we don't need to get
> into.
> 
> > If it is not guaranteed, are you blocking use of AES GCM and any other
> > block cipher that may have very bad failure modes in a situation like
> > this (in the case of AES GCM I am thinking of IV reuse) ?
> 
> I don't know what you mean.

The question was if there is *any* case where re-transmission can cause
different data to be encrypted with the same key + same IV

Simo.

-- 
Simo Sorce
RHEL Crypto Team
Red Hat, Inc



Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ