<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle21
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> +* cryptodev: The struct rte_crypto_rsa_padding will be moved from<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> + rte_crypto_rsa_op_param struct to rte_crypto_rsa_xform struct,<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> + breaking ABI. The new location is recommended to comply with<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> + virtio-crypto specification. Applications and drivers using<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> + this struct will be updated.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> +<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">The problem here, I see is that there is one private key but multiple combinations of padding.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">Therefore, for every padding variation, we need to copy the same private key anew, duplicating it in memory.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">The only reason for me to keep a session-like struct in asymmetric crypto was exactly this.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Each padding scheme in RSA has its own pros and cons (in terms of implementations as well).<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">When we share the same private key for Sign (and its public key in case of Encryption) between <o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">multiple crypto ops (varying by padding schemes among cops), a vulnerable attack against one scheme <o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">could potentially open door to used private key in the session and hence take advantage <o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">on other crypto operations.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I think, this could be one reason for why VirtIO spec mandates padding info as session parameter.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Hence, more than duplicating in memory, private and public keys are secured and in catastrophe,<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">only that session could be destroyed.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thanks,<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Gowrishankar<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Though padding schemes could be same <o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> +* cryptodev: The rte_crypto_rsa_xform struct member to hold private key<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> + in either exponent or quintuple format is changed from union to<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> +struct<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> + data type. This change is to support ASN.1 syntax (RFC 3447 Appendix A.1.2).<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> + This change will not break existing applications.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">This one I agree. RFC 8017 obsoletes RFC 3447.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thanks,<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Gowrishankar<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> --<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">> 2.21.0<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></pre>
</div>
</div>
</div>
</body>
</html>