RE: [RFC net-next 00/15] add basic PSP encryption for TCP connections

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

> > > 4. Why is the driver adding the PSP trailer? Hoping this is between the driver and the device, in our case it's the device that will add the trailer.
> 
> This for sure is by device or driver, ideally the device. Please comment.

Whether it is driver or device is a device specific implementation detail?

> A few more opens that we noticed later
> 
> 1. Key rotation should be triggered from the device as a master key in the device can be shared in a virtualized environment by many interfaces which would mean only the device can decide based on the following when to trigger the key rotation 
> 	1. Time out cannot be independent for each IKE but at a device level configuration.
> 	2.  SPI roll over, the SPI domain is again shared with multiple Interfaces that share the master key and only the device can trigger the rotation when this happens.
> 
> Apart from this, in a virtualized environment, a trigger from top (IKE down to device) to rotate the master key can cause unnecessary side effects to other interfaces that can be considered malicious.

It is possible to designate a privileged interface that is allowed to
request a key rotation. This should be supported.

For IDPF whether a driver is authorized to request a rotation can be
part of capability negotiation.