netdev - RE: [RFC net-next 00/15] add basic PSP encryption for TCP connections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <66756c7626a34_2e038a294de@willemb.c.googlers.com.notmuch>
Date: Fri, 21 Jun 2024 08:05:10 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: "Singhai, Anjali" <anjali.singhai@...el.com>, 
 Willem de Bruijn <willemdebruijn.kernel@...il.com>, 
 "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Cc: Paolo Abeni <pabeni@...hat.com>, 
 Boris Pismenny <borisp@...dia.com>, 
 "gal@...dia.com" <gal@...dia.com>, 
 "cratiu@...dia.com" <cratiu@...dia.com>, 
 "rrameshbabu@...dia.com" <rrameshbabu@...dia.com>, 
 "steffen.klassert@...unet.com" <steffen.klassert@...unet.com>, 
 "tariqt@...dia.com" <tariqt@...dia.com>, 
 Jakub Kicinski <kuba@...nel.org>, 
 "Samudrala, Sridhar" <sridhar.samudrala@...el.com>, 
 "Acharya, Arun Kumar" <arun.kumar.acharya@...el.com>
Subject: RE: [RFC net-next 00/15] add basic PSP encryption for TCP connections

> > > 4. Why is the driver adding the PSP trailer? Hoping this is between the driver and the device, in our case it's the device that will add the trailer.
> 
> This for sure is by device or driver, ideally the device. Please comment.

Whether it is driver or device is a device specific implementation detail?

> A few more opens that we noticed later
> 
> 1. Key rotation should be triggered from the device as a master key in the device can be shared in a virtualized environment by many interfaces which would mean only the device can decide based on the following when to trigger the key rotation 
> 	1. Time out cannot be independent for each IKE but at a device level configuration.
> 	2.  SPI roll over, the SPI domain is again shared with multiple Interfaces that share the master key and only the device can trigger the rotation when this happens.
> 
> Apart from this, in a virtualized environment, a trigger from top (IKE down to device) to rotate the master key can cause unnecessary side effects to other interfaces that can be considered malicious.

It is possible to designate a privileged interface that is allowed to
request a key rotation. This should be supported.

For IDPF whether a driver is authorized to request a rotation can be
part of capability negotiation.