* Re: LINUX NFS support for SHA256 hash types [not found] <CAK6vGwma1mALwE1zDUqXhGP+YHjtXdPipykui3Tt0a6NL_KOqw@mail.gmail.com> @ 2022-09-29 16:18 ` Chuck Lever III 2022-10-07 9:27 ` jaganmohan kanakala [not found] ` <CAK6vGw=50xecARE1MHmB73VrQS_OFzSqA5c1JF9AuOmjusUDNg@mail.gmail.com> 0 siblings, 2 replies; 4+ messages in thread From: Chuck Lever III @ 2022-09-29 16:18 UTC (permalink / raw) To: jaganmohan kanakala; +Cc: Linux NFS Mailing List, David Howells, linux-crypto > On Sep 28, 2022, at 8:04 AM, jaganmohan kanakala <jaganmohan.kanakala@gmail.com> wrote: > > Hi Linux-NFS team, > > I'm trying to set up the Kerberos5 setup with MIT as the KDC on my > RHEL 8 machines. > I'm able to get the setup working with Kerberos encryption types where > the hash type is SHA1 (aes128-cts-hmac-sha1-96 and > aes256-cts-hmac-sha1-96). > > As SHA1 is kind of obsolete, my goal is to get my setup working for > SHA256 hash types (aes128-cts-hmac-sha256-128, > aes256-cts-hmac-sha384-192). > > I tried that. The communication between the Linux client and MIT KDC > is aes128-cts-hmac-sha256-128, but the communication between the Linux > client and Linux NFS server is only aes256-cts-hmac-sha1-96. > > When I checked the Linux upstream code I see that there is no support > for SHA256 (and above) hash types. > > https://github.com/torvalds/linux/blob/5bfc75d92efd494db37f5c4c173d3639d4772966/net/sunrpc/auth_gss/gss_krb5_mech.c > > Have I looked at the right source code? > Does the latest Linux NFS server has support for kerberos encryption > types aes128-cts-hmac-sha256-128, aes256-cts-hmac-sha384-192 ? > > Can anyone confirm? As far as I know, the Linux in-kernel SunRPC RPCSEC GSS implementation does not support the new encryption types defined in RFC 8009. That means neither the in-kernel client or server support these types at this time. I'm not aware of plans to implement support for these. Cc'ing the crypto mailing list to see if others are considering it. -- Chuck Lever ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: LINUX NFS support for SHA256 hash types 2022-09-29 16:18 ` LINUX NFS support for SHA256 hash types Chuck Lever III @ 2022-10-07 9:27 ` jaganmohan kanakala [not found] ` <CAK6vGw=50xecARE1MHmB73VrQS_OFzSqA5c1JF9AuOmjusUDNg@mail.gmail.com> 1 sibling, 0 replies; 4+ messages in thread From: jaganmohan kanakala @ 2022-10-07 9:27 UTC (permalink / raw) To: Chuck Lever III; +Cc: Linux NFS Mailing List, David Howells, linux-crypto Hi Chuck, Many thanks for your confirmation. It helped me a lot. BR, Jaganmohan K On Thu, 29 Sept 2022 at 21:48, Chuck Lever III <chuck.lever@oracle.com> wrote: > > > > > On Sep 28, 2022, at 8:04 AM, jaganmohan kanakala <jaganmohan.kanakala@gmail.com> wrote: > > > > Hi Linux-NFS team, > > > > I'm trying to set up the Kerberos5 setup with MIT as the KDC on my > > RHEL 8 machines. > > I'm able to get the setup working with Kerberos encryption types where > > the hash type is SHA1 (aes128-cts-hmac-sha1-96 and > > aes256-cts-hmac-sha1-96). > > > > As SHA1 is kind of obsolete, my goal is to get my setup working for > > SHA256 hash types (aes128-cts-hmac-sha256-128, > > aes256-cts-hmac-sha384-192). > > > > I tried that. The communication between the Linux client and MIT KDC > > is aes128-cts-hmac-sha256-128, but the communication between the Linux > > client and Linux NFS server is only aes256-cts-hmac-sha1-96. > > > > When I checked the Linux upstream code I see that there is no support > > for SHA256 (and above) hash types. > > > > https://github.com/torvalds/linux/blob/5bfc75d92efd494db37f5c4c173d3639d4772966/net/sunrpc/auth_gss/gss_krb5_mech.c > > > > Have I looked at the right source code? > > Does the latest Linux NFS server has support for kerberos encryption > > types aes128-cts-hmac-sha256-128, aes256-cts-hmac-sha384-192 ? > > > > Can anyone confirm? > > As far as I know, the Linux in-kernel SunRPC RPCSEC GSS implementation > does not support the new encryption types defined in RFC 8009. That > means neither the in-kernel client or server support these types at > this time. > > I'm not aware of plans to implement support for these. Cc'ing the > crypto mailing list to see if others are considering it. > > > -- > Chuck Lever > > > ^ permalink raw reply [flat|nested] 4+ messages in thread
[parent not found: <CAK6vGw=50xecARE1MHmB73VrQS_OFzSqA5c1JF9AuOmjusUDNg@mail.gmail.com>]
* Re: [External] : Re: LINUX NFS support for SHA256 hash types [not found] ` <CAK6vGw=50xecARE1MHmB73VrQS_OFzSqA5c1JF9AuOmjusUDNg@mail.gmail.com> @ 2024-03-25 14:33 ` Chuck Lever III 2024-03-28 19:42 ` Scott Mayhew 0 siblings, 1 reply; 4+ messages in thread From: Chuck Lever III @ 2024-03-25 14:33 UTC (permalink / raw) To: jaganmohan kanakala, Scott Mayhew Cc: Linux NFS Mailing List, David Howells, linux-crypto > On Mar 25, 2024, at 2:34 AM, jaganmohan kanakala <jaganmohan.kanakala@gmail.com> wrote: > > Hi Chuck, > > Following up with my earlier email, I've noted from the following commit that the support for SHA 256/384 has now been added to Linux NFS. > https://github.com/torvalds/linux/commit/a40cf7530d3104793f9361e69e84ada7960724f2 > > The commit message says that the implementation was in 'beta' at the time of the commit. Is the implementation still in the 'beta' stage? "Beta" was used simply to mean that the code did not have significant test or deployment experience. So far there have been only a few bugs, all known to be fixed at the moment. > I have an NFS client where I'm trying to support SHA 256 for Krb5. How can I verify my implementation with the Linux NFS server? You will need a Linux distribution whose user space Kerberos libraries support AES_SHA2 enctypes, and of course a recent kernel. Scott, anything else? Does the KDC need to handle these enctypes too? -- Chuck Lever ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [External] : Re: LINUX NFS support for SHA256 hash types 2024-03-25 14:33 ` [External] : " Chuck Lever III @ 2024-03-28 19:42 ` Scott Mayhew 0 siblings, 0 replies; 4+ messages in thread From: Scott Mayhew @ 2024-03-28 19:42 UTC (permalink / raw) To: Chuck Lever III Cc: jaganmohan kanakala, Linux NFS Mailing List, David Howells, linux-crypto On Mon, 25 Mar 2024, Chuck Lever III wrote: > > > > On Mar 25, 2024, at 2:34 AM, jaganmohan kanakala <jaganmohan.kanakala@gmail.com> wrote: > > > > Hi Chuck, > > > > Following up with my earlier email, I've noted from the following commit that the support for SHA 256/384 has now been added to Linux NFS. > > https://github.com/torvalds/linux/commit/a40cf7530d3104793f9361e69e84ada7960724f2 > > > > The commit message says that the implementation was in 'beta' at the time of the commit. Is the implementation still in the 'beta' stage? > > "Beta" was used simply to mean that the code did not have > significant test or deployment experience. So far there > have been only a few bugs, all known to be fixed at the > moment. > > > > I have an NFS client where I'm trying to support SHA 256 for Krb5. How can I verify my implementation with the Linux NFS server? > > You will need a Linux distribution whose user space > Kerberos libraries support AES_SHA2 enctypes, and of > course a recent kernel. Scott, anything else? Does the > KDC need to handle these enctypes too? It depends on whether both the NFS client and the NFS server support the enctype negotiation extension (RFC 4537). If they do, then the KDC doesn't need to be able to handle those enctypes. -Scott > > -- Chuck Lever > > ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-03-28 19:42 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- [not found] <CAK6vGwma1mALwE1zDUqXhGP+YHjtXdPipykui3Tt0a6NL_KOqw@mail.gmail.com> 2022-09-29 16:18 ` LINUX NFS support for SHA256 hash types Chuck Lever III 2022-10-07 9:27 ` jaganmohan kanakala [not found] ` <CAK6vGw=50xecARE1MHmB73VrQS_OFzSqA5c1JF9AuOmjusUDNg@mail.gmail.com> 2024-03-25 14:33 ` [External] : " Chuck Lever III 2024-03-28 19:42 ` Scott Mayhew
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).