Re: Security enhancement proposal for kernel TLS

From: Dave Watson <davejwatson@fb.com>
To: Vakul Garg <vakul.garg@nxp.com>
Cc: "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
	Peter Doliwa <peter.doliwa@nxp.com>,
	Boris Pismenny <borisp@mellanox.com>
Subject: Re: Security enhancement proposal for kernel TLS
Date: Wed, 1 Aug 2018 13:46:47 -0700	[thread overview]
Message-ID: <20180801204647.GA6180@davejwatson-mba.dhcp.thefacebook.com> (raw)
In-Reply-To: <DB7PR04MB425268E5E200816D003B5C048B2E0@DB7PR04MB4252.eurprd04.prod.outlook.com>

On 07/31/18 10:45 AM, Vakul Garg wrote:
> > > IIUC, with the upstream implementation of tls record layer in kernel,
> > > the decryption of tls FINISHED message happens in kernel. Therefore
> > > the keys are already being sent to kernel tls socket before handshake is
> > completed.
> > 
> > This is incorrect.  
> 
> Let us first reach a common ground on this.
> 
>  The kernel TLS implementation can decrypt only after setting the keys on the socket.
> The TLS message 'finished' (which is encrypted) is received after receiving 'CCS'
> message. After the user space  TLS library receives CCS message, it sets the keys
> on kernel TLS socket. Therefore, the next message in the  socket receive queue
> which is TLS finished gets decrypted in kernel only.
> 
> Please refer to following Boris's patch on openssl. The  commit log says:
> " We choose to set this option at the earliest - just after CCS is complete".

I agree that Boris' patch does what you say it does - it sets keys
immediately after CCS instead of after FINISHED message.  I disagree
that the kernel tls implementation currently requires that specific
ordering, nor do I think that it should require that ordering.