Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "Elliott, Robert (Servers)" <elliott@hpe.com>
To:     Ard Biesheuvel <ardb@kernel.org>,
        "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>
CC:     "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
        "herbert@gondor.apana.org.au" <herbert@gondor.apana.org.au>,
        "ebiggers@kernel.org" <ebiggers@kernel.org>,
        Trond Myklebust <trond.myklebust@hammerspace.com>,
        Anna Schumaker <anna@kernel.org>,
        "Chuck Lever" <chuck.lever@oracle.com>,
        Jeff Layton <jlayton@kernel.org>,
        "Scott Mayhew" <smayhew@redhat.com>
Subject: RE: [PATCH] SUNRPC: Avoid relying on crypto API to derive CBC-CTS
 output IV
Thread-Topic: [PATCH] SUNRPC: Avoid relying on crypto API to derive CBC-CTS
 output IV
Thread-Index: AQHZfDXyDhyXxYnAq0GHBuYVn79c7K9Fe2Gw
Date:   Mon, 1 May 2023 14:40:30 +0000
Message-ID: <MW5PR84MB18421BA9A3772DC313D06E5BAB6E9@MW5PR84MB1842.NAMPRD84.PROD.OUTLOOK.COM>
References: <20230501140408.2648535-1-ardb@kernel.org>
In-Reply-To: <20230501140408.2648535-1-ardb@kernel.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?fradGXoPyy7IE68ZzQmG7bbG6Y0BX0vEndfhGT8TX/aDmHjgr0uOcEiy7fHR?=
 =?us-ascii?Q?0TzhyNY8pqhomFPaWz+cOmLLZEcPBActnAbXbgSf78WVADEErDLlRqj/+mGc?=
 =?us-ascii?Q?y4lHmUxRHWalJUEXegechjt6PweCJgzuWmAN/XI0SQGVesgNM8lppbnp7JP1?=
 =?us-ascii?Q?7vhQ0I/8ikUlIPRU/KPPvdlcux/cVGlaHQvxldkIqeKsTtx67lK0rUvTuaLo?=
 =?us-ascii?Q?TTZP+Dxujo4BiwunoUvX9YKzPI6T9Yt9rPCGzubS2W5qm6C685TNrHfJEFux?=
 =?us-ascii?Q?js6t/YGyc/gHxJ/V8nyYwWUJsMDgEwOiW35yN+H+ckWIH9OaTIbQ0ZRTtPSt?=
 =?us-ascii?Q?7VsiWwaQm6jJslNyyCS9kNsJceaw6KAwH5BxvEN4Mwgmphh9aBO9K57T1VOH?=
 =?us-ascii?Q?asjchqZ+facFBXi9Y0w0DyRyhk7TxbgkC6rrPd1TdjbMEe8Ca83ROpnArstx?=
 =?us-ascii?Q?vLV+GfcJqfqRiUX+3NPDtCEBfQlv7WG6l6KVEEldwxltaTyTNxi8UvH/AoN5?=
 =?us-ascii?Q?RBJGAAePCdMMuPRegq7+8zbgFWaBCR+QkzLWwlAVOj/07zhorCftWyq268xs?=
 =?us-ascii?Q?X8zaAusbkhR5O3VXd+pTec5Y37lPrjo7PYCAI1hnw1a2hPl0FrHX8DJfJ/OA?=
 =?us-ascii?Q?tV1mKVVh/eBNyrJ5C5IvGmr5k/AwwFBt6t950oshexQh6JPDBnBySxrnIMhG?=
 =?us-ascii?Q?SzknkmARhO2Jy8nrWV/0hejxwk7x6CiWgWXiI2pJMomZgTAi11xssp+wiiwj?=
 =?us-ascii?Q?VxZmVSmCKaZE/vlRxmCG/r3eQHJHED8ilQBFpz8FSqkzu0WCiVwTssRZUmRe?=
 =?us-ascii?Q?ZW2QrQxqxQ4n6MaGJNH6yA2myFbdm0D765jWIyIguEqwt3n+ZLGQ4lOuYPvA?=
 =?us-ascii?Q?woTOjE5Hz66qyj20H22Yjt7N+jFeF2MfgfNbLd9t9fXL5Z/K/f8w3YDnwSgN?=
 =?us-ascii?Q?gRxim1epNNRgmr7TAqX4jykx2Nfl6xp4uGUJ3jPcnLhKDsC3InCqBMGnbjn1?=
 =?us-ascii?Q?zSrlR9rEhvQKHzWUISk4SPzKmtvpDo3SLL5dNHQ57BtY1jD6PPF1c61OB8oM?=
 =?us-ascii?Q?S6W1VTkKSPtg4JRmXNCBQ3U+N9OijANOUhdHH6KYgyXJs55Ak328OPodw1tN?=
 =?us-ascii?Q?lxzhCzjXb2YpG5eYo+JgYcgCxCt6jHQj07ses/WjR3G6+BN2XysL8a2p8/Tf?=
 =?us-ascii?Q?KCKfGgabpKD03F8M9j2I/tiZikc6u/fQNPUxdMwjc4KPKAuzwcu+seMzY46/?=
 =?us-ascii?Q?vA20lgViOnHBzJ+OnCIi1ZHbx83FdwCnwoT3ZnZFFllIZFxS8VPsVWaENoOO?=
 =?us-ascii?Q?RaFOM08LUozN2lkXiDotuvoEOM4XX4AnJlbXRJf27rFa/HG1KOtP05jNyfts?=
 =?us-ascii?Q?+92sHtDuZ1TKVQoz60SebtnoCOiOMSVqXhTKjnbswLJKehv5jmPRCFCPFk7e?=
 =?us-ascii?Q?DKG6rKcuWPOLnvc8+pSEH2JJXG9hGCDWmR25QpRekSKrB5e2pAeeGSeMoSRr?=
 =?us-ascii?Q?3ApSuh0VDgWaJCfQTKFxDjevlselsowvPkWQgkm04IMUINmMJtl+378kWVR0?=
 =?us-ascii?Q?kQEdeAkhm/2GtzgYSMI=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MW5PR84MB1842.NAMPRD84.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 88a1ad33-f37f-46c9-77be-08db4a52033b
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 May 2023 14:40:30.4550
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 105b2061-b669-4b31-92ac-24d304d195dc
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 5WTF7nHHJSwZm7049Jj6T68z2o5MJEN19UcZqmA857aJGno807EZY+3OFuqBPUtN
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR84MB1507
X-OriginatorOrg: hpe.com
X-Proofpoint-GUID: NB5NSP1mbPVVuLha6vRlTZnEOIkOdMBG
X-Proofpoint-ORIG-GUID: NB5NSP1mbPVVuLha6vRlTZnEOIkOdMBG
X-HPE-SCL: -1
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-05-01_08,2023-04-27_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1011 spamscore=0
 mlxlogscore=683 mlxscore=0 adultscore=0 malwarescore=0 bulkscore=0
 impostorscore=0 lowpriorityscore=0 priorityscore=1501 phishscore=0
 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303200000 definitions=main-2305010117
X-Spam-Status: No, score=-3.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> -----Original Message-----
> From: Ard Biesheuvel <ardb@kernel.org>
> Sent: Monday, May 1, 2023 9:04 AM
> Subject: [PATCH] SUNRPC: Avoid relying on crypto API to derive CBC-CTS ou=
tput
> IV
>=20
...
> +++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
> @@ -639,6 +639,13 @@ gss_krb5_cts_crypt(struct crypto_sync_skcipher *ciph=
er,
> struct xdr_buf *buf,
>=20
>  	ret =3D write_bytes_to_xdr_buf(buf, offset, data, len);
>=20
> +	/*
> +	 * CBC-CTS does not define an output IV but RFC 3962 defines it as the
> +	 * penultimate block of ciphertext, so copy that into the IV buffer
> +	 * before returning.
> +	 */
> +	if (encrypt)
> +		memcpy(iv, data, crypto_sync_skcipher_ivsize(cipher));
>  out:
>  	kfree(data);
>  	return ret;
> --
> 2.39.2

What about the decrypt (encrypt =3D=3D 0) case?

That function supports both encrypt and decrypt operations,
and both of its callers mention this IV expectation:

gss_krb5_aes_encrypt:
        /* Make sure IV carries forward from any CBC results. */
        err =3D gss_krb5_cts_crypt(cipher, buf,
                                 offset + GSS_KRB5_TOK_HDR_LEN + cbcbytes,
                                 desc.iv, pages, 1);
gss_krb5_aes_decrypt:
        /* Make sure IV carries forward from any CBC results. */
        ret =3D gss_krb5_cts_crypt(cipher, &subbuf, cbcbytes, desc.iv, NULL=
, 0);