Re: [PATCH ipsec 0/7] xfrm: fix ESP IV generation and ESN authentication

[Steffen Klassert <steffen.klassert@secunet.com>]

On Wed, Sep 30, 2026 at 02:45:17PM +0000, Jérémy Jean wrote:
> Hello,
> 
> This series fixes nonce reuse in AES-GCM and ESN authentication errors
> in the IPv4 and IPv6 ESP offload paths:
> * 1/7 and 2/7: Save the current sequence number before incrementing it,
>                so that GCM IV construction prevents nonce reuse,
> * 3/7: Use the current sequence for software AAD and hardware offload,
> * 4/7: Give each early GSO segment a private secpath,
> * 5/7: Use the packet sequence directly for mlx5 IV generation,
> * 6/7: Segment untrusted GSO packets before allocating sequence numbers,
> * 7/7: Keep the sequence counter unchanged after full ESN overflow.
> 
> Note that triggering the bug fixed by 7/7 is impractical: it requires
> processing about 2^64 packets under a single key. Yet, I still believe
> it's cleaner to fix it.
> 
> On the crypto side, as a reminder, reusing a nonce under the same GCM
> key is catastrophic for security: it exposes the XOR of the plaintexts
> and can reveal GCM authentication key, which opens the possibilty for
> an adversary to forge ciphertexts without recovering the AES key.
> 
> This series combines and extends these two individual reports:
> * https://lore.kernel.org/all/20260925095105.446269-2-Jeremy.Jean@oss.cyber.gouv.fr/
> * https://lore.kernel.org/all/20260925095128.446450-2-Jeremy.Jean@oss.cyber.gouv.fr/
> 
> Recent discussion with Sabrina Dubroca may also be of interest:
> https://lore.kernel.org/all/c443bad568f4e03d05b848b1b245707d@oss.cyber.gouv.fr/T/#u
> 
> Regards,
> Jérémy
> 
> ---
> 
> Jérémy Jean (7):
>   xfrm: esp6: use the current sequence number for the IV
>   xfrm: esp4: use the current sequence number for the IV
>   xfrm: esp: use the current sequence number for AAD and offload
>   xfrm: prevent AES-GCM nonce reuse after early GSO
>   net/mlx5e: Use the packet sequence number for the IPsec IV
>   xfrm: segment untrusted GSO packets before sequence allocation
>   xfrm: leave the sequence counter unchanged on ESN overflow

Please rebase your patchset along with the proposed changes to
the current ipsec tree so it can get applied eventually.

Thanks!