netdev - Re: [PATCH v2 01/17] psp: add documentation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <685c89596e525_2a5da429467@willemb.c.googlers.com.notmuch>
Date: Wed, 25 Jun 2025 19:42:17 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Daniel Zahka <daniel.zahka@...il.com>, 
 Donald Hunter <donald.hunter@...il.com>, 
 Jakub Kicinski <kuba@...nel.org>, 
 "David S. Miller" <davem@...emloft.net>, 
 Eric Dumazet <edumazet@...gle.com>, 
 Paolo Abeni <pabeni@...hat.com>, 
 Simon Horman <horms@...nel.org>, 
 Jonathan Corbet <corbet@....net>, 
 Andrew Lunn <andrew+netdev@...n.ch>
Cc: Saeed Mahameed <saeedm@...dia.com>, 
 Leon Romanovsky <leon@...nel.org>, 
 Tariq Toukan <tariqt@...dia.com>, 
 Boris Pismenny <borisp@...dia.com>, 
 Kuniyuki Iwashima <kuniyu@...gle.com>, 
 Willem de Bruijn <willemb@...gle.com>, 
 David Ahern <dsahern@...nel.org>, 
 Neal Cardwell <ncardwell@...gle.com>, 
 Patrisious Haddad <phaddad@...dia.com>, 
 Raed Salem <raeds@...dia.com>, 
 Jianbo Liu <jianbol@...dia.com>, 
 Dragos Tatulea <dtatulea@...dia.com>, 
 Rahul Rameshbabu <rrameshbabu@...dia.com>, 
 Stanislav Fomichev <sdf@...ichev.me>, 
 Toke Høiland-Jørgensen <toke@...hat.com>, 
 Alexander Lobakin <aleksander.lobakin@...el.com>, 
 Jacob Keller <jacob.e.keller@...el.com>, 
 netdev@...r.kernel.org
Subject: Re: [PATCH v2 01/17] psp: add documentation

Daniel Zahka wrote:
> From: Jakub Kicinski <kuba@...nel.org>
> 
> Add documentation of things which belong in the docs rather
> than commit messages.
> 
> Signed-off-by: Jakub Kicinski <kuba@...nel.org>
> Signed-off-by: Daniel Zahka <daniel.zahka@...il.com>

> +Driver notes
> +------------
> +
> +Drivers are expected to start with no PSP enabled (``psp-versions-ena``
> +in ``dev-get`` set to ``0``) whenever possible. The user space should
> +not depend on this behavior, as future extension may necessitate creation
> +of devices with PSP already enabled, nonetheless drivers should not enable
> +PSP by default. Enabling PSP should be the responsibility of the system
> +component which also takes care of key rotation.
> +
> +Note that ``psp-versions-ena`` is expected to be used only for enabling
> +receive processing. The device is not expected to reject transmit requests

This means skb encryption for already established connections only,
right? Establishing tx offload will be rejected for new connections.

> +after ``psp-versions-ena`` has been disabled. User may also disable
> +``psp-versions-ena`` while there are active associations, which will
> +break all PSP Rx processing.
> +
> +Drivers are expected to ensure that device key is usable upon init
> +(working keys can be allocated), and that no duplicate keys may be generated
> +(reuse of SPI without key rotation). Drivers may achieve this by rotating
> +keys twice before registering the PSP device.

Since the device returns a { session_key, spi } pair, risk of reuse
is purely in firmware. I don't follow the need for the extra double
rotation.