Uploaded image for project: 'Lustre'
  1. Lustre
  2. LU-8590

Fix issues with SK privacy and integrity mode

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Blocker
    • Resolution: Fixed
    • Affects Version/s: Lustre 2.9.0
    • Fix Version/s: Lustre 2.9.0, Lustre 2.10.0
    • Labels:
      None
    • Severity:
      3
    • Rank (Obsolete):
      9223372036854775807

      Description

      Create a new ticket for tracking fixes to GSS/SK, since LU-3289 (the main feature implementation tracker) has been closed since the SSK feature is landed for 2.9.0 already.

      Several fixes are needed for skpi:

      1. The original SK patches failed to account for out of order
      handling of RPCs and bulk pages during encryption. As a result
      clients would be out of sync with the IV used for decryption.
      This patches moves the encryption to a format similar to RFC3686
      to handle these RPCs and bulk pages.

      2. A header was added to the SK mode RPCs to allow versioning and
      send the unencrypted IV used for an RPC. The versioning will allow
      for future protocol changes.

      3. Several changes to fix or improve security of the implementation
      based on a security review from Matthew Wood at Intel:

      • Derive a unique key for integrity modes instead of using the
        shared secret key (ska, ski, and skpi modes). This helps prevent
        replays.
      • Use PBKDF2 instead of HMAC to derive keys for integrity and
        encryption.
      • Have the server side pass a random value (like the client) and
        incorporate this value into the key binding information.

      4. Store generated prime into the client key file to avoid generating
      a new prime for every connection, which takes too long.

      5. Increase the default key size to 2048 bits, after #4 is done.

      Since #1 and #2 are network protocol changes, this is a blocker for the 2.9.0 release.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                jfilizetti Jeremy Filizetti
                Reporter:
                adilger Andreas Dilger
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: