LINUX NFS support for SHA256 hash types

LINUX NFS support for SHA256 hash types

[jaganmohan kanakala]

Hi Linux-NFS team,

I'm trying to set up the Kerberos5 setup with MIT as the KDC on my
RHEL 8 machines.
I'm able to get the setup working with Kerberos encryption types where
the hash type is SHA1 (aes128-cts-hmac-sha1-96 and
aes256-cts-hmac-sha1-96).

As SHA1 is kind of obsolete, my goal is to get my setup working for
SHA256 hash types (aes128-cts-hmac-sha256-128,
aes256-cts-hmac-sha384-192).

I tried that. The communication between the Linux client and MIT KDC
is aes128-cts-hmac-sha256-128, but the communication between the Linux
client and Linux NFS server is only aes256-cts-hmac-sha1-96.

When I checked the Linux upstream code I see that there is no support
for SHA256 (and above) hash types.

https://github.com/torvalds/linux/blob/5bfc75d92efd494db37f5c4c173d3639d4772966/net/sunrpc/auth_gss/gss_krb5_mech.c

Have I looked at the right source code?
Does the latest Linux NFS server has support for kerberos encryption
types aes128-cts-hmac-sha256-128, aes256-cts-hmac-sha384-192 ?

Can anyone confirm?

BR,
Jaganmohan K

Re: LINUX NFS support for SHA256 hash types

[Chuck Lever III]

> On Sep 28, 2022, at 8:04 AM, jaganmohan kanakala <jaganmohan.kanakala@gmail.com> wrote:
> 
> Hi Linux-NFS team,
> 
> I'm trying to set up the Kerberos5 setup with MIT as the KDC on my
> RHEL 8 machines.
> I'm able to get the setup working with Kerberos encryption types where
> the hash type is SHA1 (aes128-cts-hmac-sha1-96 and
> aes256-cts-hmac-sha1-96).
> 
> As SHA1 is kind of obsolete, my goal is to get my setup working for
> SHA256 hash types (aes128-cts-hmac-sha256-128,
> aes256-cts-hmac-sha384-192).
> 
> I tried that. The communication between the Linux client and MIT KDC
> is aes128-cts-hmac-sha256-128, but the communication between the Linux
> client and Linux NFS server is only aes256-cts-hmac-sha1-96.
> 
> When I checked the Linux upstream code I see that there is no support
> for SHA256 (and above) hash types.
> 
> https://github.com/torvalds/linux/blob/5bfc75d92efd494db37f5c4c173d3639d4772966/net/sunrpc/auth_gss/gss_krb5_mech.c
> 
> Have I looked at the right source code?
> Does the latest Linux NFS server has support for kerberos encryption
> types aes128-cts-hmac-sha256-128, aes256-cts-hmac-sha384-192 ?
> 
> Can anyone confirm?

As far as I know, the Linux in-kernel SunRPC RPCSEC GSS implementation
does not support the new encryption types defined in RFC 8009. That
means neither the in-kernel client or server support these types at
this time.

I'm not aware of plans to implement support for these. Cc'ing the
crypto mailing list to see if others are considering it.


--
Chuck Lever

Re: LINUX NFS support for SHA256 hash types

[jaganmohan kanakala]

Hi Chuck,

Many thanks for your confirmation. It helped me a lot.

BR,
Jaganmohan K

On Thu, 29 Sept 2022 at 21:48, Chuck Lever III <chuck.lever@oracle.com> wrote:
>
>
>
> > On Sep 28, 2022, at 8:04 AM, jaganmohan kanakala <jaganmohan.kanakala@gmail.com> wrote:
> >
> > Hi Linux-NFS team,
> >
> > I'm trying to set up the Kerberos5 setup with MIT as the KDC on my
> > RHEL 8 machines.
> > I'm able to get the setup working with Kerberos encryption types where
> > the hash type is SHA1 (aes128-cts-hmac-sha1-96 and
> > aes256-cts-hmac-sha1-96).
> >
> > As SHA1 is kind of obsolete, my goal is to get my setup working for
> > SHA256 hash types (aes128-cts-hmac-sha256-128,
> > aes256-cts-hmac-sha384-192).
> >
> > I tried that. The communication between the Linux client and MIT KDC
> > is aes128-cts-hmac-sha256-128, but the communication between the Linux
> > client and Linux NFS server is only aes256-cts-hmac-sha1-96.
> >
> > When I checked the Linux upstream code I see that there is no support
> > for SHA256 (and above) hash types.
> >
> > https://github.com/torvalds/linux/blob/5bfc75d92efd494db37f5c4c173d3639d4772966/net/sunrpc/auth_gss/gss_krb5_mech.c
> >
> > Have I looked at the right source code?
> > Does the latest Linux NFS server has support for kerberos encryption
> > types aes128-cts-hmac-sha256-128, aes256-cts-hmac-sha384-192 ?
> >
> > Can anyone confirm?
>
> As far as I know, the Linux in-kernel SunRPC RPCSEC GSS implementation
> does not support the new encryption types defined in RFC 8009. That
> means neither the in-kernel client or server support these types at
> this time.
>
> I'm not aware of plans to implement support for these. Cc'ing the
> crypto mailing list to see if others are considering it.
>
>
> --
> Chuck Lever
>
>
>

Re: [External] : Re: LINUX NFS support for SHA256 hash types

[Chuck Lever III]

> On Mar 25, 2024, at 2:34 AM, jaganmohan kanakala <jaganmohan.kanakala@gmail.com> wrote:
> 
> Hi Chuck,
> 
> Following up with my earlier email, I've noted from the following commit that the support for SHA 256/384 has now been added to Linux NFS.
> https://github.com/torvalds/linux/commit/a40cf7530d3104793f9361e69e84ada7960724f2
> 
> The commit message says that the implementation was in 'beta' at the time of the commit. Is the implementation still in the 'beta' stage?

"Beta" was used simply to mean that the code did not have
significant test or deployment experience. So far there
have been only a few bugs, all known to be fixed at the
moment.


> I have an NFS client where I'm trying to support SHA 256 for Krb5. How can I verify my implementation with the Linux NFS server?

You will need a Linux distribution whose user space
Kerberos libraries support AES_SHA2 enctypes, and of
course a recent kernel. Scott, anything else? Does the
KDC need to handle these enctypes too?

--
Chuck Lever

Re: [External] : Re: LINUX NFS support for SHA256 hash types

[Scott Mayhew]

On Mon, 25 Mar 2024, Chuck Lever III wrote:

> 
> 
> > On Mar 25, 2024, at 2:34 AM, jaganmohan kanakala <jaganmohan.kanakala@gmail.com> wrote:
> > 
> > Hi Chuck,
> > 
> > Following up with my earlier email, I've noted from the following commit that the support for SHA 256/384 has now been added to Linux NFS.
> > https://github.com/torvalds/linux/commit/a40cf7530d3104793f9361e69e84ada7960724f2
> > 
> > The commit message says that the implementation was in 'beta' at the time of the commit. Is the implementation still in the 'beta' stage?
> 
> "Beta" was used simply to mean that the code did not have
> significant test or deployment experience. So far there
> have been only a few bugs, all known to be fixed at the
> moment.
> 
> 
> > I have an NFS client where I'm trying to support SHA 256 for Krb5. How can I verify my implementation with the Linux NFS server?
> 
> You will need a Linux distribution whose user space
> Kerberos libraries support AES_SHA2 enctypes, and of
> course a recent kernel. Scott, anything else? Does the
> KDC need to handle these enctypes too?

It depends on whether both the NFS client and the NFS server support the
enctype negotiation extension (RFC 4537).  If they do, then the KDC
doesn't need to be able to handle those enctypes.

-Scott

> 
> -- Chuck Lever
> 
>