Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     jaganmohan kanakala <jaganmohan.kanakala@gmail.com>
CC:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        David Howells <dhowells@redhat.com>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>
Subject: Re: LINUX NFS support for SHA256 hash types
Thread-Topic: LINUX NFS support for SHA256 hash types
Thread-Index: AQHY0zKLaDiZfQG1FkW5IfB4RW19Ga32l+4A
Date:   Thu, 29 Sep 2022 16:18:52 +0000
Message-ID: <2DC5A71F-F7B7-401B-954E-6A0656BDC6A9@oracle.com>
References: <CAK6vGwma1mALwE1zDUqXhGP+YHjtXdPipykui3Tt0a6NL_KOqw@mail.gmail.com>
In-Reply-To: <CAK6vGwma1mALwE1zDUqXhGP+YHjtXdPipykui3Tt0a6NL_KOqw@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?O2CFE09RPnG1mR//BUnQFxUXje9iyqBpPajrPUES8MjPZuf5MEfUFIERsMnV?=
 =?us-ascii?Q?ag/0WhbKN860rU+reoc+H1EsxAd1tCjR+bMh3TVOIEjuDWmFFF/07d+pn48y?=
 =?us-ascii?Q?qpBvzDVEaeryomlkinvm4WwKMPwLF01yiDHIoZwh29L/JOn0djOoXhETQpvY?=
 =?us-ascii?Q?LFAaYESYHZwC8uUO9ErtdE07AlqV+gELZBPe3sX8nU1QljIH9SHLojzTKUo2?=
 =?us-ascii?Q?pkIXbsgb1iuNU9tpztzodpphbxCTqkWriLCXLHEStwSwXr3O0ZFiMgelVOTC?=
 =?us-ascii?Q?dLXA2NF7gAOkjCz/6Yaw9LFRPsqFcnRhVdJPgWrFranx/0YlUxDQkeuRZFH4?=
 =?us-ascii?Q?CB/iL2E66Kl1WUqGFb6WKWwqTTzIrnHX94mo7Bu9U9ErBpV5qT5AWe6J4aoC?=
 =?us-ascii?Q?1apdfDvDlBNuI49bHRWyifAOq6/IqVddwXoThBsWgwxPM6SSqfbX6INebIo8?=
 =?us-ascii?Q?DlIT6ze5w17UM+d8RCEYCmrHLNv1Jskl7zTxFrMZvNYJN7XiGrbV8z5VMjdp?=
 =?us-ascii?Q?IqUFq4O4kmNbeewEEnkclmXgdm+brwXX8A1BQWOmpEBoXDmq1x2xT/KVrD/Y?=
 =?us-ascii?Q?XrOetJh7BRy/GRrXjqJt09BttSsGM6BL2L5v272EwOMsXPh5eW0bTolte+L6?=
 =?us-ascii?Q?4tkgOn2XWUulU00Z4O0godg5e5D683jIps9O8jhX/+5Qyy0todSU+vREZ1EV?=
 =?us-ascii?Q?KDE4u3MDq3FUtcVIvIwpQ1P73gYYE1DJh+uAyACVu5jfQMJY+fHglZPQy2v3?=
 =?us-ascii?Q?MefH6BG0Ro9djeCLEnMcWrHz+OXthEys5RHHXiKYSdvjYZO61sy8k5ufZF0I?=
 =?us-ascii?Q?oSEuNLiJQfbfzK6uztRJeyEnRqEO/PzFKqWU9gXXDGU/yTjpO4LpVmYY3/+h?=
 =?us-ascii?Q?235Hfa17cvD6nE08iSIwiazY4QRd9j86e2v2Mr6UiHJjijGxRdI4E7uujn2G?=
 =?us-ascii?Q?31/XOo7dZrd34itTiedTi55WX2qXnFCJMR00CvNMEZOz7ziRHMZ509Axi1IT?=
 =?us-ascii?Q?ZgMQe/imk0IgFARj8JTt086EAVBSqKifHQ5fako/d+K4N4HZkO5sGwoD4ULp?=
 =?us-ascii?Q?7ker+za0XpFMCX7bMuO6BjOfUD6Dyd64BUyPquj4F6Jtk7RAOGQIaeCViTNM?=
 =?us-ascii?Q?BWsm6i3TJVRmXgYqilor5SQ40ZEV+mFZ07klWUqa1NkfBPzO/4/tmmkl2b7S?=
 =?us-ascii?Q?mjJoCPKL/w2mMJgaLiKzD2dogkSCsRK0GB7CXNt5zCIWvTyorutaPwWgqD5j?=
 =?us-ascii?Q?kOvznq6UVZtiUfezsN/9yDs/zIfWYZDOK1sxDmooSutSVGRkvSOlsXCvAw8V?=
 =?us-ascii?Q?egIi/w6HphwHxZYzvvNiJ0xl+yG/7Y2SLi7ZAd8jTC3Cag0Gm+9qFb3bA09A?=
 =?us-ascii?Q?oBY2J6MQjUfOLbUIh+7aEHVuCstd93UQR936jF0s+1klYRHeM5SDQ0xnY0L6?=
 =?us-ascii?Q?h/biS9MpIMp6InCbB++9eohHHtvMtSru5xeiJ5Ww+HNOFivUksEPcCbXzc/9?=
 =?us-ascii?Q?bAfiE3UzRKmjBW1svBwnKPfj+YkXAUBWYCqG+OvTeaC4WM33G6kxOb/wEv8x?=
 =?us-ascii?Q?J2qGZ3O8Y3UNuIP+Ws18ctSVcqOTY2CRouOGyfb5oyUulh9fFNQola2zvslw?=
 =?us-ascii?Q?sA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <14BD3B1984F7C946A51F1767383E493A@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9618538c-0b32-46e5-a1fb-08daa2364d01
X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Sep 2022 16:18:52.9764
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: ZFKiqWzHHxEeRyH06w+E6jWIvi+kDxMOLjXDOTJEd6xYxTaAZ5hxK2D8DQARIsyUhUn2PO1xlWRMnvKiHf6kGg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR10MB4122
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-09-29_09,2022-09-29_03,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 bulkscore=0 mlxscore=0
 suspectscore=0 malwarescore=0 adultscore=0 spamscore=0 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000
 definitions=main-2209290102
X-Proofpoint-GUID: SQifiUYUhSXxa6jq8uSSPW4HpHkD8CkJ
X-Proofpoint-ORIG-GUID: SQifiUYUhSXxa6jq8uSSPW4HpHkD8CkJ
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org


> On Sep 28, 2022, at 8:04 AM, jaganmohan kanakala <jaganmohan.kanakala@gma=
il.com> wrote:
>=20
> Hi Linux-NFS team,
>=20
> I'm trying to set up the Kerberos5 setup with MIT as the KDC on my
> RHEL 8 machines.
> I'm able to get the setup working with Kerberos encryption types where
> the hash type is SHA1 (aes128-cts-hmac-sha1-96 and
> aes256-cts-hmac-sha1-96).
>=20
> As SHA1 is kind of obsolete, my goal is to get my setup working for
> SHA256 hash types (aes128-cts-hmac-sha256-128,
> aes256-cts-hmac-sha384-192).
>=20
> I tried that. The communication between the Linux client and MIT KDC
> is aes128-cts-hmac-sha256-128, but the communication between the Linux
> client and Linux NFS server is only aes256-cts-hmac-sha1-96.
>=20
> When I checked the Linux upstream code I see that there is no support
> for SHA256 (and above) hash types.
>=20
> https://github.com/torvalds/linux/blob/5bfc75d92efd494db37f5c4c173d3639d4=
772966/net/sunrpc/auth_gss/gss_krb5_mech.c
>=20
> Have I looked at the right source code?
> Does the latest Linux NFS server has support for kerberos encryption
> types aes128-cts-hmac-sha256-128, aes256-cts-hmac-sha384-192 ?
>=20
> Can anyone confirm?

As far as I know, the Linux in-kernel SunRPC RPCSEC GSS implementation
does not support the new encryption types defined in RFC 8009. That
means neither the in-kernel client or server support these types at
this time.

I'm not aware of plans to implement support for these. Cc'ing the
crypto mailing list to see if others are considering it.


--
Chuck Lever