netdev - Re: [PATCH net-next 0/5] tls: implement key updates for TLS1.3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b610a041864cf696a686ba00910c252713ace0fe.camel@redhat.com>
Date:   Wed, 25 Jan 2023 18:52:49 -0500
From:   Simo Sorce <simo@...hat.com>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     Apoorv Kothari <apoorvko@...zon.com>, sd@...asysnail.net,
        borisp@...dia.com, dueno@...hat.com, fkrenzel@...hat.com,
        gal@...dia.com, netdev@...r.kernel.org, tariqt@...dia.com
Subject: Re: [PATCH net-next 0/5] tls: implement key updates for TLS1.3

On Wed, 2023-01-25 at 15:08 -0800, Jakub Kicinski wrote:
> On Wed, 25 Jan 2023 18:05:38 -0500 Simo Sorce wrote:
> > > > If it is not guaranteed, are you blocking use of AES GCM and any other
> > > > block cipher that may have very bad failure modes in a situation like
> > > > this (in the case of AES GCM I am thinking of IV reuse) ?  
> > > 
> > > I don't know what you mean.  
> > 
> > The question was if there is *any* case where re-transmission can cause
> > different data to be encrypted with the same key + same IV
> 
> Not in valid use cases. With zero-copy / sendfile Tx technically 
> the page from the page cache can change between tx and rtx, but 
> the user needs to opt in explicitly acknowledging the application 
> will prevent this from happening. If they don't opt-in we'll copy 
> the data.

Uhmm is there a way to detect this happening and abort further crypto
operations in case it happens ?

Simo.

-- 
Simo Sorce
RHEL Crypto Team
Red Hat, Inc