Re: [RFC PATCH 00/24] crypto: Add generic Kerberos library with AEAD template for hash-then-crypt

[Chuck Lever <chuck.lever@oracle.com>]

On 1/17/25 1:35 PM, David Howells wrote:
> Hi Herbert, Chuck,
> 
> Here's yet another go at a generic Kerberos crypto library in the kernel so
> that I can share code between rxrpc and sunrpc (and cifs?).  I derived some
> of the parts from the sunrpc gss library and added more advanced AES and
> Camellia crypto.
> 
> I added an addition AEAD template type, derived from authenc, that does
> hash-then-crypt rather than crypt-then-hash as authenc does.  I called it
> "krb5enc" for want of a better name.  Possibly I should call it "hashenc"
> or something like that.
> 
> I went back to my previous more library-based approach, but for encrypt
> mode, I replaced the separate skcipher and shash objects with a single
> templated AEAD object - either krb5enc (AES+SHA1 and Camellia) or authenc
> (AES+SHA2).

I'm philosophically in favor of sharing this code. One of the biggest
benefits will be making review/audit easier. Another will be the
opportunities for more hardware acceleration.

But I can't tell if the library API as laid out here will be a good fit
for SunRPC and our kernel XDR implementation until I actually try to use
the API, which I don't have time for right now. The set of enctypes
indeed seems sufficient to support GSS-API Kerberos, and that is a
fundamental requirement for us.

The Linux in-kernel SMB community might be interested in sharing some of
this too, though they seem to have grown their own enctypes. The Cc list
on the thread is already substantial, but they should be included.

I think it would be fine to merge this, as long as the crypto folks are
happy with it, with its current single consumer (RxRPC), and then we can
explore broader sharing.


> Apart from that, things are much as they were previously from the point of
> view of someone using the API.  There's a new pair of functions that, given
> an encoding type, a key and a usage value, will derive the necessary keys
> and return an AEAD or hash handle.  These handles can then be passed to
> operation functions that will do the actual work of performing an
> encryption, a decryption, MIC generation or MIC verification.
> 
> Querying functions are also available to look up an encoding type table by
> kerberos protocol number and to help manage message layout.
> 
> This library has its own self-testing framework that checks more things
> than is possible with the testmgr, including subkey derivation.  It also
> checks things about the output of encrypt + decrypt that testmgr doesn't.
> That said, testmgr is also provisioned with some encryption and
> checksumming tests for Camilla and AES2, though these have to be
> provisioned with the intermediate subkeys rather than the transport key.
> 
> Note that, for purposes of illustration, I've included some rxrpc patches
> that use this interface to implement the rxgk Rx security class.  The
> branch also is based on net-next that carries some rxrpc patches that are a
> prerequisite for this, but the crypto patches don't need it.
> 
> ---
> The patches can be found here also:
> 
> 	http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=crypto-krb5
> 
> David
> 
> David Howells (24):
>    crypto/krb5: Add API Documentation
>    crypto/krb5: Add some constants out of sunrpc headers
>    crypto: Add 'krb5enc' hash and cipher AEAD algorithm
>    crypto/krb5: Test manager data
>    crypto/krb5: Implement Kerberos crypto core
>    crypto/krb5: Add an API to query the layout of the crypto section
>    crypto/krb5: Add an API to alloc and prepare a crypto object
>    crypto/krb5: Add an API to perform requests
>    crypto/krb5: Provide infrastructure and key derivation
>    crypto/krb5: Implement the Kerberos5 rfc3961 key derivation
>    crypto/krb5: Provide RFC3961 setkey packaging functions
>    crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt
>      functions
>    crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic
>    crypto/krb5: Implement the AES enctypes from rfc3962
>    crypto/krb5: Implement the AES enctypes from rfc8009
>    crypto/krb5: Implement the AES encrypt/decrypt from rfc8009
>    crypto/krb5: Implement crypto self-testing
>    crypto/krb5: Add the AES self-testing data from rfc8009
>    crypto/krb5: Implement the Camellia enctypes from rfc6803
>    rxrpc: Add the security index for yfs-rxgk
>    rxrpc: Add YFS RxGK (GSSAPI) security class
>    rxrpc: rxgk: Provide infrastructure and key derivation
>    rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)
>    rxrpc: rxgk: Implement connection rekeying
> 
>   Documentation/crypto/index.rst   |    1 +
>   Documentation/crypto/krb5.rst    |  262 +++++++
>   crypto/Kconfig                   |   13 +
>   crypto/Makefile                  |    3 +
>   crypto/krb5/Kconfig              |   26 +
>   crypto/krb5/Makefile             |   18 +
>   crypto/krb5/internal.h           |  257 +++++++
>   crypto/krb5/krb5_api.c           |  452 ++++++++++++
>   crypto/krb5/krb5_kdf.c           |  145 ++++
>   crypto/krb5/rfc3961_simplified.c |  791 ++++++++++++++++++++
>   crypto/krb5/rfc3962_aes.c        |  115 +++
>   crypto/krb5/rfc6803_camellia.c   |  237 ++++++
>   crypto/krb5/rfc8009_aes2.c       |  431 +++++++++++
>   crypto/krb5/selftest.c           |  544 ++++++++++++++
>   crypto/krb5/selftest_data.c      |  291 ++++++++
>   crypto/krb5enc.c                 |  491 +++++++++++++
>   crypto/testmgr.c                 |   16 +
>   crypto/testmgr.h                 |  401 ++++++++++
>   fs/afs/misc.c                    |   13 +
>   include/crypto/krb5.h            |  167 +++++
>   include/keys/rxrpc-type.h        |   17 +
>   include/trace/events/rxrpc.h     |   36 +
>   include/uapi/linux/rxrpc.h       |   17 +
>   net/rxrpc/Kconfig                |   10 +
>   net/rxrpc/Makefile               |    5 +-
>   net/rxrpc/ar-internal.h          |   22 +
>   net/rxrpc/conn_event.c           |    2 +-
>   net/rxrpc/conn_object.c          |    1 +
>   net/rxrpc/key.c                  |  183 +++++
>   net/rxrpc/output.c               |    2 +-
>   net/rxrpc/protocol.h             |   20 +
>   net/rxrpc/rxgk.c                 | 1170 ++++++++++++++++++++++++++++++
>   net/rxrpc/rxgk_app.c             |  284 ++++++++
>   net/rxrpc/rxgk_common.h          |  140 ++++
>   net/rxrpc/rxgk_kdf.c             |  287 ++++++++
>   net/rxrpc/rxkad.c                |    6 +-
>   net/rxrpc/security.c             |    3 +
>   37 files changed, 6874 insertions(+), 5 deletions(-)
>   create mode 100644 Documentation/crypto/krb5.rst
>   create mode 100644 crypto/krb5/Kconfig
>   create mode 100644 crypto/krb5/Makefile
>   create mode 100644 crypto/krb5/internal.h
>   create mode 100644 crypto/krb5/krb5_api.c
>   create mode 100644 crypto/krb5/krb5_kdf.c
>   create mode 100644 crypto/krb5/rfc3961_simplified.c
>   create mode 100644 crypto/krb5/rfc3962_aes.c
>   create mode 100644 crypto/krb5/rfc6803_camellia.c
>   create mode 100644 crypto/krb5/rfc8009_aes2.c
>   create mode 100644 crypto/krb5/selftest.c
>   create mode 100644 crypto/krb5/selftest_data.c
>   create mode 100644 crypto/krb5enc.c
>   create mode 100644 include/crypto/krb5.h
>   create mode 100644 net/rxrpc/rxgk.c
>   create mode 100644 net/rxrpc/rxgk_app.c
>   create mode 100644 net/rxrpc/rxgk_common.h
>   create mode 100644 net/rxrpc/rxgk_kdf.c
> 


-- 
Chuck Lever