From: Eric Biggers <ebiggers@kernel.org> Date: 2020-06-10 00:57:44
This series consolidates and modernizes the lists of crypto algorithms
that are selected by the IPsec kconfig options, and adds CRYPTO_SEQIV
since it no longer gets selected automatically by other things.
See previous discussion at
https://lkml.kernel.org/netdev/20200604192322.22142-1-ebiggers@kernel.org/T/#u
Eric Biggers (3):
esp, ah: consolidate the crypto algorithm selections
esp: select CRYPTO_SEQIV
esp, ah: modernize the crypto algorithm selections
net/ipv4/Kconfig | 37 +++++++++++++++++++++----------------
net/ipv6/Kconfig | 37 +++++++++++++++++++++----------------
net/xfrm/Kconfig | 24 ++++++++++++++++++++++++
3 files changed, 66 insertions(+), 32 deletions(-)
base-commit: 8027bc0307ce59759b90679fa5d8b22949586d20
--
2.26.2
From: Eric Biggers <ebiggers@kernel.org> Date: 2020-06-10 00:57:47
From: Eric Biggers <redacted>
Commit f23efcbcc523 ("crypto: ctr - no longer needs CRYPTO_SEQIV") made
CRYPTO_CTR stop selecting CRYPTO_SEQIV. This breaks IPsec for most
users since GCM and several other encryption algorithms require "seqiv"
-- and RFC 8221 lists AES-GCM as "MUST" be implemented.
Just make XFRM_ESP select CRYPTO_SEQIV.
Fixes: f23efcbcc523 ("crypto: ctr - no longer needs CRYPTO_SEQIV") made
Cc: Corentin Labbe <clabbe@baylibre.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Eric Biggers <redacted>
---
net/xfrm/Kconfig | 1 +
1 file changed, 1 insertion(+)
From: Eric Biggers <ebiggers@kernel.org> Date: 2020-06-10 00:57:54
From: Eric Biggers <redacted>
The crypto algorithms selected by the ESP and AH kconfig options are
out-of-date with the guidance of RFC 8221, which lists the legacy
algorithms MD5 and DES as "MUST NOT" be implemented, and some more
modern algorithms like AES-GCM and HMAC-SHA256 as "MUST" be implemented.
But the options select the legacy algorithms, not the modern ones.
Therefore, modify these options to select the MUST algorithms --
and *only* the MUST algorithms.
Also improve the help text.
Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
Suggested-by: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Corentin Labbe <clabbe@baylibre.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Eric Biggers <redacted>
---
net/ipv4/Kconfig | 21 +++++++++++++++++++--
net/ipv6/Kconfig | 21 +++++++++++++++++++--
net/xfrm/Kconfig | 15 +++++++++------
3 files changed, 47 insertions(+), 10 deletions(-)
@@ -67,26 +67,29 @@ config XFRM_STATISTICSIfunsure,sayN.+# This option selects XFRM_ALGO along with the AH authentication algorithms that+# RFC 8221 lists as MUST be implemented.configXFRM_AHtristateselectXFRM_ALGOselectCRYPTOselectCRYPTO_HMAC-selectCRYPTO_MD5-selectCRYPTO_SHA1+selectCRYPTO_SHA256+# This option selects XFRM_ALGO along with the ESP encryption and authentication+# algorithms that RFC 8221 lists as MUST be implemented.configXFRM_ESPtristateselectXFRM_ALGOselectCRYPTO+selectCRYPTO_AESselectCRYPTO_AUTHENC-selectCRYPTO_HMAC-selectCRYPTO_MD5selectCRYPTO_CBC-selectCRYPTO_SHA1-selectCRYPTO_DESselectCRYPTO_ECHAINIV+selectCRYPTO_GCM+selectCRYPTO_HMACselectCRYPTO_SEQIV+selectCRYPTO_SHA256configXFRM_IPCOMPtristate
From: Eric Biggers <ebiggers@kernel.org> Date: 2020-06-10 00:57:54
From: Eric Biggers <redacted>
Instead of duplicating the algorithm selections between INET_AH and
INET6_AH and between INET_ESP and INET6_ESP, create new tristates
XFRM_AH and XFRM_ESP that do the algorithm selections, and make these be
selected by the corresponding INET* options.
Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Corentin Labbe <clabbe@baylibre.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Eric Biggers <redacted>
---
net/ipv4/Kconfig | 16 ++--------------
net/ipv6/Kconfig | 16 ++--------------
net/xfrm/Kconfig | 20 ++++++++++++++++++++
3 files changed, 24 insertions(+), 28 deletions(-)
From: Herbert Xu <herbert@gondor.apana.org.au> Date: 2020-06-10 01:01:01
On Tue, Jun 09, 2020 at 05:54:00PM -0700, Eric Biggers wrote:
From: Eric Biggers <redacted>
Instead of duplicating the algorithm selections between INET_AH and
INET6_AH and between INET_ESP and INET6_ESP, create new tristates
XFRM_AH and XFRM_ESP that do the algorithm selections, and make these be
selected by the corresponding INET* options.
Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Corentin Labbe <clabbe@baylibre.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Eric Biggers <redacted>
---
net/ipv4/Kconfig | 16 ++--------------
net/ipv6/Kconfig | 16 ++--------------
net/xfrm/Kconfig | 20 ++++++++++++++++++++
3 files changed, 24 insertions(+), 28 deletions(-)
From: Herbert Xu <herbert@gondor.apana.org.au> Date: 2020-06-10 01:01:05
On Tue, Jun 09, 2020 at 05:54:01PM -0700, Eric Biggers wrote:
From: Eric Biggers <redacted>
Commit f23efcbcc523 ("crypto: ctr - no longer needs CRYPTO_SEQIV") made
CRYPTO_CTR stop selecting CRYPTO_SEQIV. This breaks IPsec for most
users since GCM and several other encryption algorithms require "seqiv"
-- and RFC 8221 lists AES-GCM as "MUST" be implemented.
Just make XFRM_ESP select CRYPTO_SEQIV.
Fixes: f23efcbcc523 ("crypto: ctr - no longer needs CRYPTO_SEQIV") made
Cc: Corentin Labbe <clabbe@baylibre.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Eric Biggers <redacted>
---
net/xfrm/Kconfig | 1 +
1 file changed, 1 insertion(+)
From: Herbert Xu <herbert@gondor.apana.org.au> Date: 2020-06-10 01:01:14
On Tue, Jun 09, 2020 at 05:54:02PM -0700, Eric Biggers wrote:
From: Eric Biggers <redacted>
The crypto algorithms selected by the ESP and AH kconfig options are
out-of-date with the guidance of RFC 8221, which lists the legacy
algorithms MD5 and DES as "MUST NOT" be implemented, and some more
modern algorithms like AES-GCM and HMAC-SHA256 as "MUST" be implemented.
But the options select the legacy algorithms, not the modern ones.
Therefore, modify these options to select the MUST algorithms --
and *only* the MUST algorithms.
Also improve the help text.
Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
Suggested-by: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Corentin Labbe <clabbe@baylibre.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Eric Biggers <redacted>
---
net/ipv4/Kconfig | 21 +++++++++++++++++++--
net/ipv6/Kconfig | 21 +++++++++++++++++++--
net/xfrm/Kconfig | 15 +++++++++------
3 files changed, 47 insertions(+), 10 deletions(-)
+ Note that RFC 8221 considers AH itself to be "NOT RECOMMENDED". It is
+ better to use ESP only, using an AEAD cipher such as AES-GCM.
What's NOT RECOMMENDED according to the RFC is the combination of ESP+AH
(i.e. use ESP only for confidentiality and AH for authentication), not
AH by itself (although the RFC keeps ENCR_NULL as a MUST because ESP
with NULL encryption is generally preferred over AH due to NATs).
Regards,
Tobias
From: Eric Biggers <ebiggers@kernel.org> Date: 2020-06-10 15:53:14
On Wed, Jun 10, 2020 at 11:03:55AM +0200, Tobias Brunner wrote:
Hi Eric,
quoted
+ Note that RFC 8221 considers AH itself to be "NOT RECOMMENDED". It is
+ better to use ESP only, using an AEAD cipher such as AES-GCM.
What's NOT RECOMMENDED according to the RFC is the combination of ESP+AH
(i.e. use ESP only for confidentiality and AH for authentication), not
AH by itself (although the RFC keeps ENCR_NULL as a MUST because ESP
with NULL encryption is generally preferred over AH due to NATs).
Regards,
Tobias
Okay, I'll drop this paragraph. I'm surprised that authentication-only is still
considered a valid use case though.
- Eric