Re: [PATCH 08/18] nvme-tcp: enable TLS handshake upcall

Sagi Grimberg
2023-03-22T13:16:14Z

>> I have a more general question.
>> What is the scenario that we will have for a given hostnqn and
>> subsysnqn more than one valid identity? Do we need to support it?
>>
> Well; there are SHA-256 and SHA-384 identities. We need to _support_
> both, but seeing that we're dealing with retained PSKs for now I would
> assume that the admin ensures that both sides are able to support the
> chosen hash.

Yes, lets not over-complicate it.

> So the real choice is just between a 'retained' and a 'generated' PSK.
> And it is assumed that any 'retained' PSK should take priority for any
> 'generated' PSK.
> So for 'retained' PSKs we can use userland to pass in the PSK
> (or, indeed, having the kernel select one as we really only have on
> choice...)
> And for 'generated' PSKs they really come into play only if we don't
> have 'retained' PSKs, and if secure concatenation is enabled.
> But even there you can (out of necessity) only generate a single PSK,
> so again there is no choice.
>
> So in the light of all this I guess we can revert to only using a single
> PSK.

This makes perfect sense to me.