| Message ID | 20210910064322.67705-1-hare@suse.de (mailing list archive) |
|---|---|
| Headers | show |
| Series | nvme: In-band authentication support | expand |
> Hi all, > > recent updates to the NVMe spec have added definitions for in-band > authentication, and seeing that it provides some real benefit > especially for NVMe-TCP here's an attempt to implement it. > > Tricky bit here is that the specification orients itself on TLS 1.3, > but supports only the FFDHE groups. Which of course the kernel doesn't > support. I've been able to come up with a patch for this, but as this > is my first attempt to fix anything in the crypto area I would invite > people more familiar with these matters to have a look. > > Also note that this is just for in-band authentication. Secure > concatenation (ie starting TLS with the negotiated parameters) is not > implemented; one would need to update the kernel TLS implementation > for this, which at this time is beyond scope. > > As usual, comments and reviews are welcome. Still no nvme-cli nor nvmetcli :(
On 9/13/21 11:16 AM, Sagi Grimberg wrote: > >> Hi all, >> >> recent updates to the NVMe spec have added definitions for in-band >> authentication, and seeing that it provides some real benefit >> especially for NVMe-TCP here's an attempt to implement it. >> >> Tricky bit here is that the specification orients itself on TLS 1.3, >> but supports only the FFDHE groups. Which of course the kernel doesn't >> support. I've been able to come up with a patch for this, but as this >> is my first attempt to fix anything in the crypto area I would invite >> people more familiar with these matters to have a look. >> >> Also note that this is just for in-band authentication. Secure >> concatenation (ie starting TLS with the negotiated parameters) is not >> implemented; one would need to update the kernel TLS implementation >> for this, which at this time is beyond scope. >> >> As usual, comments and reviews are welcome. > > Still no nvme-cli nor nvmetcli :( Just send it (for libnvme and nvme-cli). Patch for nvmetcli to follow. Cheers, Hannes
>>> Hi all, >>> >>> recent updates to the NVMe spec have added definitions for in-band >>> authentication, and seeing that it provides some real benefit >>> especially for NVMe-TCP here's an attempt to implement it. >>> >>> Tricky bit here is that the specification orients itself on TLS 1.3, >>> but supports only the FFDHE groups. Which of course the kernel doesn't >>> support. I've been able to come up with a patch for this, but as this >>> is my first attempt to fix anything in the crypto area I would invite >>> people more familiar with these matters to have a look. >>> >>> Also note that this is just for in-band authentication. Secure >>> concatenation (ie starting TLS with the negotiated parameters) is not >>> implemented; one would need to update the kernel TLS implementation >>> for this, which at this time is beyond scope. >>> >>> As usual, comments and reviews are welcome. >> >> Still no nvme-cli nor nvmetcli :( > > Just send it (for libnvme and nvme-cli). Patch for nvmetcli to follow. Hey Hannes, I think that this series is getting into close-to-inclustion shape. Please in your next respin: 1. Make sure to send nvme-cli and nvmetcli with the series 2. Collect Review tags Thanks!