linux.git/drivers/nvme/common, branch master

nvme-auth: Hash DH shared secret to create session key

2026-04-22T20:02:16+00:00

The NVMe Base Specification 8.3.5.5.9 states that the session key Ks
shall be computed from the ephemeral DH key by applying the hash
function selected by the HashID parameter.

The current implementation stores the raw DH shared secret as the
session key without hashing it. This causes redundant hash operations:

1. Augmented challenge computation (section 8.3.5.5.4) requires
   Ca = HMAC(H(g^xy mod p), C). The code compensates by hashing the
   unhashed session key in nvme_auth_augmented_challenge() to produce
   the correct result.

2. PSK generation (section 8.3.5.5.9) requires PSK = HMAC(Ks, C1 || C2)
   where Ks should already be H(g^xy mod p). As the DH shared secret
   is always larger than the HMAC block size, HMAC internally hashes
   it before use, accidentally producing the correct result.

When using secure channel concatenation with bidirectional
authentication, this results in hashing the DH value three times: twice
for augmented challenge calculations and once during PSK generation.

Fix this by:
- Modifying nvme_auth_gen_shared_secret() to hash the DH shared secret
  once after computation: Ks = H(g^xy mod p)
- Removing the hash operation from nvme_auth_augmented_challenge()
  as the session key is now already hashed
- Updating session key buffer size from DH key size to hash output size
- Adding specification references in comments

This avoid storing the raw DH shared secret and reduces the number of
hash operations from three to one when using secure channel
concatenation.

Reviewed-by: Hannes Reinecke 
Reviewed-by: Eric Biggers 
Signed-off-by: Chris Leech 
Signed-off-by: Keith Busch

nvme-auth: common: remove selections of no-longer used crypto modules

2026-03-27T14:35:03+00:00

Now that nvme-auth uses the crypto library instead of crypto_shash,
remove obsolete selections from the NVME_AUTH kconfig option.

Acked-by: Ard Biesheuvel 
Acked-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Eric Biggers 
Signed-off-by: Keith Busch

nvme-auth: common: remove nvme_auth_digest_name()

2026-03-27T14:35:02+00:00

Since nvme_auth_digest_name() is no longer used, remove it and the
associated data from the hash_map array.

Acked-by: Ard Biesheuvel 
Acked-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Eric Biggers 
Signed-off-by: Keith Busch

nvme-auth: common: use crypto library in nvme_auth_derive_tls_psk()

2026-03-27T14:35:01+00:00

For the HKDF-Expand-Label computation in nvme_auth_derive_tls_psk(), use
the crypto library instead of crypto_shash and crypto/hkdf.c.

While this means the HKDF "helper" functions are no longer utilized,
they clearly weren't buying us much: it's simpler to just inline the
HMAC computations directly, and this code needs to be tested anyway.  (A
similar result was seen in fs/crypto/.  As a result, this eliminates the
last user of crypto/hkdf.c, which we'll be able to remove as well.)

As usual this is also a lot more efficient, eliminating the allocation
of a transformation object and multiple other dynamic allocations.

Acked-by: Ard Biesheuvel 
Acked-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Eric Biggers 
Signed-off-by: Keith Busch

nvme-auth: common: use crypto library in nvme_auth_generate_digest()

2026-03-27T14:35:01+00:00

For the HMAC computation in nvme_auth_generate_digest(), use the crypto
library instead of crypto_shash.  This is simpler, faster, and more
reliable.  Notably, this eliminates the crypto transformation object
allocation for every call, which was very slow.

Acked-by: Ard Biesheuvel 
Acked-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Eric Biggers 
Signed-off-by: Keith Busch

nvme-auth: common: use crypto library in nvme_auth_generate_psk()

2026-03-27T14:35:01+00:00

For the HMAC computation in nvme_auth_generate_psk(), use the crypto
library instead of crypto_shash.  This is simpler, faster, and more
reliable.  Notably, this eliminates the crypto transformation object
allocation for every call, which was very slow.

Acked-by: Ard Biesheuvel 
Acked-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Eric Biggers 
Signed-off-by: Keith Busch

nvme-auth: common: use crypto library in nvme_auth_augmented_challenge()

2026-03-27T14:35:01+00:00

For the hash and HMAC computations in nvme_auth_augmented_challenge(),
use the crypto library instead of crypto_shash.  This is simpler,
faster, and more reliable.  Notably, this eliminates two crypto
transformation object allocations for every call, which was very slow.

Acked-by: Ard Biesheuvel 
Acked-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Eric Biggers 
Signed-off-by: Keith Busch

nvme-auth: common: use crypto library in nvme_auth_transform_key()

2026-03-27T14:35:01+00:00

For the HMAC computation in nvme_auth_transform_key(), use the crypto
library instead of crypto_shash.  This is simpler, faster, and more
reliable.  Notably, this eliminates the transformation object allocation
for every call, which was very slow.

Acked-by: Ard Biesheuvel 
Acked-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Eric Biggers 
Signed-off-by: Keith Busch

nvme-auth: common: add HMAC helper functions

2026-03-27T14:35:01+00:00

Add some helper functions for computing HMAC-SHA256, HMAC-SHA384, or
HMAC-SHA512 values using the crypto library instead of crypto_shash.
These will enable some significant simplifications and performance
improvements in nvme-auth.

Acked-by: Ard Biesheuvel 
Acked-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Eric Biggers 
Signed-off-by: Keith Busch

nvme-auth: common: explicitly verify psk_len == hash_len

2026-03-27T14:35:00+00:00

nvme_auth_derive_tls_psk() is always called with psk_len == hash_len.
And based on the comments above nvme_auth_generate_psk() and
nvme_auth_derive_tls_psk(), this isn't an implementation choice but
rather just the length the spec uses.  Add a check which makes this
explicit, so that when cleaning up nvme_auth_derive_tls_psk() we don't
have to retain support for arbitrary values of psk_len.

Acked-by: Ard Biesheuvel 
Acked-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Eric Biggers 
Signed-off-by: Keith Busch