SUNRPC: Obscure Kerberos signing keys

Browse source

There's no need to keep the signing keys around if we instead allocate
and key an ahash and keep that. This not only enables the subkeys to
be destroyed immediately after deriving them, but it makes the
Kerberos signing code path more efficient.

Tested-by: Scott Mayhew <smayhew@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

...

This commit is contained in:

Chuck Lever 2023-01-15 12:21:07 -05:00

parent 9f0b49f933

commit 2dbe0cac3c

6 changed files with 127 additions and 48 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

include/linux/sunrpc/gss_krb5.h

View file

70

net/sunrpc/auth_gss/gss_krb5_crypto.c

View file

4

net/sunrpc/auth_gss/gss_krb5_internal.h

View file

37

net/sunrpc/auth_gss/gss_krb5_mech.c

View file

30

net/sunrpc/auth_gss/gss_krb5_seal.c

View file

29

net/sunrpc/auth_gss/gss_krb5_unseal.c

View file