From: Hannes Reinecke <hare@kernel.org>
To: Christoph Hellwig <hch@lst.de>
Cc: Sagi Grimberg <sagi@grimberg.me>, Keith Busch <kbusch@kernel.org>,
linux-nvme@lists.infradead.org, Hannes Reinecke <hare@suse.de>
Subject: [PATCH 06/17] nvme: add nvme_auth_derive_tls_psk()
Date: Mon, 18 Mar 2024 16:03:05 +0100 [thread overview]
Message-ID: <20240318150316.138501-7-hare@kernel.org> (raw)
In-Reply-To: <20240318150316.138501-1-hare@kernel.org>
From: Hannes Reinecke <hare@suse.de>
Add a function to derive the TLS PSK as specified TP8018.
Signed-off-by: Hannes Reinecke <hare@suse.de>
---
drivers/nvme/common/auth.c | 71 ++++++++++++++++++++++++++++++++++++++
include/linux/nvme-auth.h | 1 +
2 files changed, 72 insertions(+)
diff --git a/drivers/nvme/common/auth.c b/drivers/nvme/common/auth.c
index f56f08a4461e..90d525afc240 100644
--- a/drivers/nvme/common/auth.c
+++ b/drivers/nvme/common/auth.c
@@ -652,5 +652,76 @@ u8 *nvme_auth_generate_digest(u8 hmac_id, u8 *psk, size_t psk_len,
}
EXPORT_SYMBOL_GPL(nvme_auth_generate_digest);
+u8 *nvme_auth_derive_tls_psk(int hmac_id, u8 *psk, size_t psk_len, u8 *psk_digest)
+{
+ struct crypto_shash *hmac_tfm;
+ const char *hmac_name;
+ const char *psk_prefix = "tls13 nvme-tls-psk";
+ size_t info_len, prk_len;
+ char *info;
+ unsigned char *prk, *tls_key;
+ int ret;
+
+ hmac_name = nvme_auth_hmac_name(hmac_id);
+ if (!hmac_name) {
+ pr_warn("%s: invalid hash algoritm %d\n",
+ __func__, hmac_id);
+ return ERR_PTR(-EINVAL);
+ }
+ if (hmac_id == NVME_AUTH_HASH_SHA512) {
+ pr_warn("%s: unsupported hash algorithm %s\n",
+ __func__, hmac_name);
+ return ERR_PTR(-EINVAL);
+ }
+
+ hmac_tfm = crypto_alloc_shash(hmac_name, 0, 0);
+ if (IS_ERR(hmac_tfm))
+ return (u8 *)hmac_tfm;
+
+ prk_len = crypto_shash_digestsize(hmac_tfm);
+ prk = kzalloc(prk_len, GFP_KERNEL);
+ if (!prk) {
+ ret = -ENOMEM;
+ goto out_free_shash;
+ }
+
+ ret = hkdf_extract(hmac_tfm, psk, psk_len, prk);
+ if (ret)
+ goto out_free_prk;
+
+ ret = crypto_shash_setkey(hmac_tfm, prk, prk_len);
+ if (ret)
+ goto out_free_prk;
+
+ info_len = strlen(psk_digest) + strlen(psk_prefix) + 1;
+ info = kzalloc(info_len, GFP_KERNEL);
+ if (!info)
+ goto out_free_prk;
+
+ memcpy(info, psk_prefix, strlen(psk_prefix));
+ memcpy(info + strlen(psk_prefix), psk_digest, strlen(psk_digest));
+
+ tls_key = kzalloc(psk_len, GFP_KERNEL);
+ if (!tls_key) {
+ ret = -ENOMEM;
+ goto out_free_info;
+ }
+ ret = hkdf_expand(hmac_tfm, info, strlen(info), tls_key, psk_len);
+ if (ret)
+ goto out_free_key;
+
+out_free_key:
+ kfree(tls_key);
+out_free_info:
+ kfree(info);
+out_free_prk:
+ kfree(prk);
+out_free_shash:
+ crypto_free_shash(hmac_tfm);
+
+ return ret ? ERR_PTR(ret) : tls_key;
+}
+EXPORT_SYMBOL_GPL(nvme_auth_derive_tls_psk);
+
MODULE_DESCRIPTION("NVMe Authentication framework");
MODULE_LICENSE("GPL v2");
diff --git a/include/linux/nvme-auth.h b/include/linux/nvme-auth.h
index 2cbb9249a8b3..335236fb2b73 100644
--- a/include/linux/nvme-auth.h
+++ b/include/linux/nvme-auth.h
@@ -44,5 +44,6 @@ u8 *nvme_auth_generate_psk(u8 hmac_id, u8 *skey, size_t skey_len,
u8 *c1, u8 *c2, size_t hash_len, size_t *ret_len);
u8 *nvme_auth_generate_digest(u8 hmac_id, u8 *psk, size_t psk_len,
char *subsysnqn, char *hostnqn);
+u8 *nvme_auth_derive_tls_psk(int hmac_id, u8 *psk, size_t psk_len, u8 *psk_digest);
#endif /* _NVME_AUTH_H */
--
2.35.3
next prev parent reply other threads:[~2024-03-18 15:03 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-18 15:02 [PATCHv3 00/17] nvme: implement secure concatenation Hannes Reinecke
2024-03-18 15:03 ` [PATCH 01/17] nvme-keyring: restrict match length for version '1' identifiers Hannes Reinecke
2024-03-18 15:03 ` [PATCH 02/17] nvme-tcp: check for invalidated or revoked key Hannes Reinecke
2024-04-07 20:51 ` Sagi Grimberg
2024-04-08 5:18 ` Hannes Reinecke
2024-03-18 15:03 ` [PATCH 03/17] crypto,fs: Separate out hkdf_extract() and hkdf_expand() Hannes Reinecke
2024-03-18 15:03 ` [PATCH 04/17] nvme: add nvme_auth_generate_psk() Hannes Reinecke
2024-04-07 20:59 ` Sagi Grimberg
2024-04-08 5:20 ` Hannes Reinecke
2024-03-18 15:03 ` [PATCH 05/17] nvme: add nvme_auth_generate_digest() Hannes Reinecke
2024-04-07 21:02 ` Sagi Grimberg
2024-03-18 15:03 ` Hannes Reinecke [this message]
2024-04-07 21:04 ` [PATCH 06/17] nvme: add nvme_auth_derive_tls_psk() Sagi Grimberg
2024-04-18 11:00 ` Hannes Reinecke
2024-03-18 15:03 ` [PATCH 07/17] nvme-keyring: add nvme_tls_psk_refresh() Hannes Reinecke
2024-03-18 15:03 ` [PATCH 08/17] nvme-tcp: sanitize TLS key handling Hannes Reinecke
2024-04-07 21:15 ` Sagi Grimberg
2024-04-08 6:48 ` Hannes Reinecke
2024-04-08 21:07 ` Sagi Grimberg
2024-04-08 21:32 ` Hannes Reinecke
2024-03-18 15:03 ` [PATCH 09/17] nvme-tcp: do not quiesce admin queue in nvme_tcp_teardown_io_queues() Hannes Reinecke
2024-04-07 21:24 ` Sagi Grimberg
2024-04-18 11:33 ` Hannes Reinecke
2024-03-18 15:03 ` [PATCH 10/17] nvme: add a newline to the 'tls_key' sysfs attribute Hannes Reinecke
2024-04-07 21:24 ` Sagi Grimberg
2024-03-18 15:03 ` [PATCH 11/17] nvme-tcp: request secure channel concatenation Hannes Reinecke
2024-04-07 21:41 ` Sagi Grimberg
2024-04-08 5:32 ` Hannes Reinecke
2024-04-08 21:09 ` Sagi Grimberg
2024-04-08 21:48 ` Hannes Reinecke
2024-04-21 11:14 ` Sagi Grimberg
2024-03-18 15:03 ` [PATCH 12/17] nvme-fabrics: reset connection for secure concatenation Hannes Reinecke
2024-04-07 21:46 ` Sagi Grimberg
2024-04-08 6:21 ` Hannes Reinecke
2024-04-08 21:21 ` Sagi Grimberg
2024-04-08 22:08 ` Hannes Reinecke
2024-04-21 11:20 ` Sagi Grimberg
2024-05-08 9:21 ` Hannes Reinecke
2024-03-18 15:03 ` [PATCH 13/17] nvme-tcp: reset after recovery " Hannes Reinecke
2024-04-07 21:49 ` Sagi Grimberg
2024-04-08 6:25 ` Hannes Reinecke
2024-04-08 21:23 ` Sagi Grimberg
2024-04-08 22:10 ` Hannes Reinecke
2024-04-21 11:22 ` Sagi Grimberg
2024-04-21 14:37 ` Hannes Reinecke
2024-04-21 15:09 ` Sagi Grimberg
2024-03-18 15:03 ` [PATCH 14/17] nvmet-auth: allow to clear DH-HMAC-CHAP keys Hannes Reinecke
2024-04-07 21:50 ` Sagi Grimberg
2024-03-18 15:03 ` [PATCH 15/17] nvme-target: do not check authentication status for admin commands twice Hannes Reinecke
2024-04-07 21:53 ` Sagi Grimberg
2024-03-18 15:03 ` [PATCH 16/17] nvme-target: do not check authentication status for I/O " Hannes Reinecke
2024-04-07 21:53 ` Sagi Grimberg
2024-03-18 15:03 ` [PATCH 17/17] nvmet-tcp: support secure channel concatenation Hannes Reinecke
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240318150316.138501-7-hare@kernel.org \
--to=hare@kernel.org \
--cc=hare@suse.de \
--cc=hch@lst.de \
--cc=kbusch@kernel.org \
--cc=linux-nvme@lists.infradead.org \
--cc=sagi@grimberg.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).