Implement version 1 TLS identities as specified in TP8018 #748
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Separate out a function 'select_hmac' and pass in the HMAC value to 'derive_retained_keys' and 'derive_tls_keys'. Signed-off-by: Hannes Reinecke <[email protected]>
…eys' Separate out a function to generate the TLS identity; this allows us to reshuffle 'derive_nvme_keys()' to compile it only when KEYUTILS is selected. Signed-off-by: Hannes Reinecke <[email protected]>
Copied over from nvme-cli. Signed-off-by: Hannes Reinecke <[email protected]>
With NVMe TP8018 a new version '1' for generating NVMe TLS identities was specified; identities generated for this version require a PSK hash to be attached to the version '0' identifier. This patch implements a new function 'nvme_insert_tls_keys_versioned()' to support this functionality and makes the original function 'nvme_insert_tls_keys()' a wrapper for the new function. Signed-off-by: Hannes Reinecke <[email protected]>
Implement a function to generate the TLS key identity. Signed-off-by: Hannes Reinecke <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
TP8018 specified a new version 1 for TLS identifiers, where the original (version 0) identifiers are suffixed with a PSK hash.
That allows for key rotation as the new identifiers will change whenever the key changes, thus allowing the client to request the correct key after a key rotation.