netdev - Re: [RFC net-next 00/15] add basic PSP encryption for TCP connections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 28 May 2024 11:33:33 -0400 (EDT)
From: Paul Wouters <paul@...ats.ca>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>
cc: Steffen Klassert <steffen.klassert@...unet.com>, 
    Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org, 
    pabeni@...hat.com, borisp@...dia.com, gal@...dia.com, cratiu@...dia.com, 
    rrameshbabu@...dia.com, tariqt@...dia.com
Subject: Re: [RFC net-next 00/15] add basic PSP encryption for TCP
 connections

On Tue, 28 May 2024, Willem de Bruijn wrote:

> One point about why PSP is that the exact protocol and packet format
> is already in use and supported by hardware.

Using mostly the IPsec hw code? :)

> It makes sense to work to get to an IETF standard protocol that
> captures the same benefits. But that is independent from enabling what
> is already implemented.

How many different packet encryption methods should the linux kernel
have? There are good reasons to go through standard bodies. Doing your
own thing and then saying "but we did it already" to me does not feel
like a strong argument. That's how we got wireguard with all of its
issues of being written for a single use case, and now being unfit for
generic use cases.

Going through standards organizations also gains you interoperability
with non-linux (hardware) vendors, again reducing the number of
different mostly similar schemes that need to be supported and
maintained for years or decades.

Paul