Re: [PATCHv2 0/2] nvme: restrict authentication to the admin queue

[Hannes Reinecke <hare@suse.de>]

On 3/13/25 18:29, Kamaljit Singh wrote:
> Hi Hannes,
> 
> One of the key TLS handshake issues we faced is with SHA384 and I see 
> that you had requested this gnutls fix ~2 years ago. I’m curious how you 
> got around that.
> 
> https://gitlab.com/gnutls/gnutls/-/issues/386 <https://gitlab.com/ 
> gnutls/gnutls/-/issues/386>
> 
> We had to hardcode gnutls v3.8.9 to change its default SHA256 to SHA384 
> for using the appropriate binder length.
> 
Yeah, that is quite annoying.
Guess I'll have to bite the bullet and fix gnutls.
Especially as even the maintainer acknowledged that it's an
issue.

BTW, the secure concatenation fixes are now merged with the nvme-6.15 
branch at git.infradead.org/nvme.git, and I've opened a pull request
for blktest:
https://github.com/osandov/blktests/pull/158
which should test possible combinations.
No test for the binder hash, I'm afraid; if you have ideas how to test
this I'd be happy to take them.

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare@suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich