From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 34938D58E7E for ; Mon, 2 Mar 2026 08:01:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:Message-ID:Date:Subject:Cc:To:From:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=unN9zFEqrGyIvv5Z8Jn1UE7kzZChfYyzyba8rFvc958=; b=1kju/5mcjC60wwTPXtyN3/xDC5 Mlt69bvnnS3MItzf1Wp9KLZKcL+DinqjpZGCWfXWAlIPE+LiJFqLtc5wVHUzvmQf0fa1KzWwlKaah FoVZUI7vT+/O+IL3OhONkIvc1i6VMoBlKq7pGv6nhU44jn//9V/wpneAcqhgnCu8FStZFgAFQ5WX2 iZT8DjWUGebZb+Oo5PnZJlIeVUNmQErTtWNuSDhCfULuXvZQv9WiF60F4OMNuMkx/HgtTK/YHDcwt tlkmrHr/rnQ/DArhTw66Y1Y+DSU+lKv3xrDd5+FF5FDw8veQ36hUJoZMVvRKqzs0m0dJrQVNHF+6K ox+OhQrg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1vwyDT-0000000CSYj-1Ast; Mon, 02 Mar 2026 08:01:23 +0000 Received: from sea.source.kernel.org ([172.234.252.31]) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1vwyDQ-0000000CSXC-1Y20 for linux-nvme@lists.infradead.org; Mon, 02 Mar 2026 08:01:21 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id AB40E42AC3; Mon, 2 Mar 2026 08:01:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 33EF9C2BCAF; Mon, 2 Mar 2026 08:01:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772438479; bh=harymnB7hCX/JjGHppJgWSHiwMixCAs5CzazQ0NoDZU=; h=From:To:Cc:Subject:Date:From; b=SRgASHfdbLnhF9xMKATAZFw1YLttrhvaHwDhCnn+CTUqgRHBxPiwKi97jZ6v6hnvF hLgIEjo1xHoNtP12rQgHF9NzlxUkKt92IAeOtcuKfet3BBLT65Am2Q3ourzptXzTkm lMfAkPd/RxjX3BIhsuFOTS/05gvmPcY1MYUpGYKfVUBeV3NYEcN5f3QdssHFE9mLBY zFGD9e2OEBWLzHAzvyrIZFwAH2MhFRgnzMDKbFL5F41PhQwxCqMc5oDBbvH98r6Jf3 shdw0AFx9q+OYb6KtvDJ5e8wP7DNyAwbAH9qGnpIyFHtkvNK74oic+5gixllz3tDcg xYOmG4gfa/pLg== From: Eric Biggers To: linux-nvme@lists.infradead.org, Chaitanya Kulkarni , Sagi Grimberg , Christoph Hellwig , Hannes Reinecke Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Ard Biesheuvel , "Jason A . Donenfeld" , Herbert Xu , Eric Biggers Subject: [PATCH 00/21] nvme-auth: use crypto library for HMAC and hashing Date: Sun, 1 Mar 2026 23:59:38 -0800 Message-ID: <20260302075959.338638-1-ebiggers@kernel.org> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260302_000120_453918_03F900B9 X-CRM114-Status: GOOD ( 14.39 ) X-BeenThere: linux-nvme@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Linux-nvme" Errors-To: linux-nvme-bounces+linux-nvme=archiver.kernel.org@lists.infradead.org This series converts the implementation of NVMe in-band authentication to use the crypto library instead of crypto_shash for HMAC and hashing. The result is simpler, faster, and more reliable. Notably, it eliminates a lot of dynamic memory allocations, indirect calls, lookups in crypto_alg_list, and other API overhead. It also uses the library's support for initializing HMAC contexts directly from a raw key, which is an optimization not accessible via crypto_shash. Finally, a lot of the error handling code goes away, since the library functions just always succeed and return void. The last patch removes crypto/hkdf.c, as it's no longer needed. This series applies to v7.0-rc1 and is targeting the nvme tree. I've tested the TLS key derivation using the KUnit test suite added in this series. I don't know how to test the other parts, but it all should behave the same as before. Eric Biggers (21): nvme-auth: add NVME_AUTH_MAX_DIGEST_SIZE constant nvme-auth: common: constify static data nvme-auth: use proper argument types nvme-auth: common: add KUnit tests for TLS key derivation nvme-auth: rename nvme_auth_generate_key() to nvme_auth_parse_key() nvme-auth: common: explicitly verify psk_len == hash_len nvme-auth: common: add HMAC helper functions nvme-auth: common: use crypto library in nvme_auth_transform_key() nvme-auth: common: use crypto library in nvme_auth_augmented_challenge() nvme-auth: common: use crypto library in nvme_auth_generate_psk() nvme-auth: common: use crypto library in nvme_auth_generate_digest() nvme-auth: common: use crypto library in nvme_auth_derive_tls_psk() nvme-auth: host: use crypto library in nvme_auth_dhchap_setup_host_response() nvme-auth: host: use crypto library in nvme_auth_dhchap_setup_ctrl_response() nvme-auth: host: remove allocation of crypto_shash nvme-auth: target: remove obsolete crypto_has_shash() checks nvme-auth: target: use crypto library in nvmet_auth_host_hash() nvme-auth: target: use crypto library in nvmet_auth_ctrl_hash() nvme-auth: common: remove nvme_auth_digest_name() nvme-auth: common: remove selections of no-longer used crypto modules crypto: remove HKDF library crypto/Kconfig | 6 - crypto/Makefile | 1 - crypto/hkdf.c | 573 ------------------------ drivers/nvme/common/.kunitconfig | 6 + drivers/nvme/common/Kconfig | 14 +- drivers/nvme/common/Makefile | 2 + drivers/nvme/common/auth.c | 587 ++++++++++--------------- drivers/nvme/common/tests/auth_kunit.c | 175 ++++++++ drivers/nvme/host/auth.c | 160 +++---- drivers/nvme/host/sysfs.c | 4 +- drivers/nvme/target/auth.c | 198 +++------ drivers/nvme/target/configfs.c | 3 - drivers/nvme/target/fabrics-cmd-auth.c | 4 +- drivers/nvme/target/nvmet.h | 2 +- include/crypto/hkdf.h | 20 - include/linux/nvme-auth.h | 41 +- include/linux/nvme.h | 5 + 17 files changed, 571 insertions(+), 1230 deletions(-) delete mode 100644 crypto/hkdf.c create mode 100644 drivers/nvme/common/.kunitconfig create mode 100644 drivers/nvme/common/tests/auth_kunit.c delete mode 100644 include/crypto/hkdf.h base-commit: 6de23f81a5e08be8fbf5e8d7e9febc72a5b5f27f -- 2.53.0