[RFC PATCH 00/11] nvme: implement secure concatenation

hare
2024-01-23T14:19:29Z

Hi all,

here's my attempt to implement secure concatenation for NVMe-of TCP
as outlined in TP8018.
Secure concatenation means that a TLS PSK is generated from the key
material negotiated by the DH-HMAC-CHAP protocol, and the TLS PSK
is then used for a subsequent TLS connection.
The difference between the original definition of secure concatenation
and the method outlined in TP8018 is that with TP8018 the connection
is reset after DH-HMAC-CHAP negotiation, and a new connection is setup
with the generated TLS PSK.

To implement that I have decided on resetting the connection from the
nvme-tcp driver after the initial connection has been set up.
Another way would have been to offload the connection reset to userspace,
and let nvme-cli reset the connection. But that would be a modification
to the userspace interface, and hence I didn't go that way.

As usual, comments and reviews are welcome.

Hannes Reinecke (11):
crypto,fs: Separate out hkdf_extract() and hkdf_expand()
nvme: add nvme_auth_generate_psk()
nvme: add nvme_auth_generate_digest()
nvme: add nvme_auth_derive_tls_psk()
nvme-keyring: add nvme_tls_psk_refresh()
nvme-keyring: restrict match length for version '1' identifiers
nvme-tcp: check for invalidated or revoked key
nvme-fabrics: authentication errors are not retryable
nvme: add nvme_noretry_error()
nvme-tcp: request secure channel concatenation
nvmet-tcp: support secure channel concatenation

crypto/Makefile | 1 +
crypto/hkdf.c | 111 +++++++++++
drivers/nvme/common/auth.c | 252 +++++++++++++++++++++++++
drivers/nvme/common/keyring.c | 71 +++++++
drivers/nvme/host/auth.c | 108 ++++++++++-
drivers/nvme/host/core.c | 2 +-
drivers/nvme/host/fabrics.c | 46 ++++-
drivers/nvme/host/fabrics.h | 3 +
drivers/nvme/host/fc.c | 4 +-
drivers/nvme/host/nvme.h | 10 +
drivers/nvme/host/tcp.c | 46 +++--
drivers/nvme/target/auth.c | 62 +++++-
drivers/nvme/target/fabrics-cmd-auth.c | 43 ++++-
drivers/nvme/target/fabrics-cmd.c | 27 ++-
drivers/nvme/target/nvmet.h | 16 +-
drivers/nvme/target/tcp.c | 26 +++
fs/crypto/hkdf.c | 68 +------
include/crypto/hkdf.h | 18 ++
include/linux/nvme-auth.h | 5 +
include/linux/nvme-keyring.h | 7 +
include/linux/nvme.h | 7 +
21 files changed, 824 insertions(+), 109 deletions(-)
create mode 100644 crypto/hkdf.c
create mode 100644 include/crypto/hkdf.h

--
2.35.3