<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">We need to fix padding info in DPDK as per VirtIO specification in order to support RSA in virtio devices. VirtIO-crypto specification and DPDK specification differs in the way padding is handled.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">With current DPDK & virtio specification, it is impossible to support RSA in virtio-crypto. If you think DPDK spec should not be modified, we will try to amend the virtIO spec to match DPDK, but since we do
not know if the virtIO community would accept, can we merge the deprecation notice?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Gowrishankar<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerEnd<o:p></o:p></span></p>
</div>
<div>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>> +* cryptodev: The struct rte_crypto_rsa_padding will be moved from<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>> + rte_crypto_rsa_op_param struct to rte_crypto_rsa_xform struct,<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>> + breaking ABI. The new location is recommended to comply with<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>> + virtio-crypto specification. Applications and drivers using<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>> + this struct will be updated.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>> +<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>> The problem here, I see is that there is one private key but multiple combinations of padding.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>> Therefore, for every padding variation, we need to copy the same private key anew, duplicating it in memory.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>> The only reason for me to keep a session-like struct in asymmetric crypto was exactly this.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></pre>
</div>
</div>
</div>
</div>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">> Each padding scheme in RSA has its own pros and cons (in terms of implementations as well).<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">> When we share the same private key for Sign (and its public key in case of Encryption) between <o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">> multiple crypto ops (varying by padding schemes among cops), a vulnerable attack against one scheme <o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">> could potentially open door to used private key in the session and hence take advantage <o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">> on other crypto operations.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">> I think, this could be one reason for why VirtIO spec mandates padding info as session parameter.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">> Hence, more than duplicating in memory, private and public keys are secured and in catastrophe,<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">> only that session could be destroyed.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>> +* cryptodev: The rte_crypto_rsa_xform struct member to hold private key<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>> + in either exponent or quintuple format is changed from union to<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>> +struct<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>> + data type. This change is to support ASN.1 syntax (RFC 3447 Appendix A.1.2).<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>> + This change will not break existing applications.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif">>>This one I agree. RFC 8017 obsoletes RFC 3447.<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">> Thanks,<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">> Gowrishankar<o:p></o:p></span></pre>
<pre><span style="font-size:11.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></pre>
</div>
</body>
</html>