From: Stefan Metzmacher <metze@samba.org>
To: Enzo Matsumiya <ematsumiya@suse.de>, linux-cifs@vger.kernel.org
Cc: smfrench@gmail.com, pc@cjr.nz, ronniesahlberg@gmail.com,
nspmangalore@gmail.com, tom@talpey.com
Subject: Re: [PATCH v3 5/8] cifs: introduce AES-GMAC signing support for SMB 3.1.1
Date: Thu, 29 Sep 2022 07:14:46 +0200 [thread overview]
Message-ID: <1ec4803d-e367-96f5-855d-8d48fc40260b@samba.org> (raw)
In-Reply-To: <20220929015637.14400-6-ematsumiya@suse.de>
Hi Enzo,
> +/*
> + * This function implements AES-GMAC signing for SMB2 messages as described in MS-SMB2
> + * specification. This algorithm is only supported on SMB 3.1.1.
> + *
> + * Note: even though Microsoft mentions RFC4543 in MS-SMB2, the mechanism used_must_ be the "raw"
> + * AES-128-GCM ("gcm(aes)"); RFC4543 is designed for IPsec and trying to use "rfc4543(gcm(aes)))"
> + * will fail the signature computation.
> + *
> + * MS-SMB2 3.1.4.1
> + */
> +int
> +smb311_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, bool verify)
> +{
Can you please add aes_gmac to the function name?
> + union {
> + struct {
> + /* for MessageId (8 bytes) */
> + __le64 mid;
> + /* for role (client or server) and if SMB2 CANCEL (4 bytes) */
> + __le32 role;
> + };
> + u8 buffer[12];
> + } __packed nonce;
Can you use SMB3_AES_GCM_NONCE instead of '12'?
metze
next prev parent reply other threads:[~2022-09-29 5:15 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-29 1:56 [PATCH v3 0/8] cifs: introduce support for AES-GMAC signing Enzo Matsumiya
2022-09-29 1:56 ` [PATCH v3 1/8] smb3: rename encryption/decryption TFMs Enzo Matsumiya
2022-09-29 5:18 ` Steve French
2022-09-29 1:56 ` [PATCH v3 2/8] cifs: secmech: use shash_desc directly, remove sdesc Enzo Matsumiya
2022-09-29 1:56 ` [PATCH v3 3/8] cifs: allocate ephemeral secmechs only on demand Enzo Matsumiya
2022-09-29 5:23 ` Steve French
2022-09-29 1:56 ` [PATCH v3 4/8] cifs: create sign/verify secmechs, don't leave keys in memory Enzo Matsumiya
2022-09-29 1:56 ` [PATCH v3 5/8] cifs: introduce AES-GMAC signing support for SMB 3.1.1 Enzo Matsumiya
2022-09-29 5:14 ` Stefan Metzmacher [this message]
2022-09-29 14:16 ` Enzo Matsumiya
2022-09-29 5:22 ` Steve French
2022-09-29 1:56 ` [PATCH v3 6/8] cifs: deprecate 'enable_negotiate_signing' module param Enzo Matsumiya
2022-09-29 5:22 ` Steve French
2022-09-29 14:18 ` Enzo Matsumiya
2022-09-29 1:56 ` [PATCH v3 7/8] cifs: show signing algorithm name in DebugData Enzo Matsumiya
2022-09-29 1:56 ` [PATCH v3 8/8] cifs: use MAX_CIFS_SMALL_BUFFER_SIZE-8 as padding buffer Enzo Matsumiya
2022-09-29 5:45 ` Stefan Metzmacher
2022-09-29 15:17 ` Enzo Matsumiya
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1ec4803d-e367-96f5-855d-8d48fc40260b@samba.org \
--to=metze@samba.org \
--cc=ematsumiya@suse.de \
--cc=linux-cifs@vger.kernel.org \
--cc=nspmangalore@gmail.com \
--cc=pc@cjr.nz \
--cc=ronniesahlberg@gmail.com \
--cc=smfrench@gmail.com \
--cc=tom@talpey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox