the better slot?

I think I've managed to track down why a machine was failing ML_KEM in
libreswan, but it brings up several questions.

First the libreswan bug:

- the IKE_SA_INIT exchange generates a KE DH secret
- this secret is fed into the KDF which returns keymat and a key D
with slot A (I'm not sure where that slot came from)
- the IKE_INTERMEDIATE exchange generates an ADDKE ML_KEM secret with
an ML_KEM slot
- D+ADDKE are then fed into the KDF (CKM_NSS_IKE_PRF_DERIVE) which
barfs (fails gracefully) because ADDKE (.hNewKey) isn't in D's slot

Presumably the fix is to get both D and ADDKE on the same slot:

Q.1 But which is the better slot?  D or the one that was for ML_KEM?
Q.2 Why would we only encounter the problem on one machine?

More broadly:

Do slots have any (multi threaded) performance implications?  For
instance, in the above, I've a suspicion that D's slot is being shared
across threads and is very long lived

Andrew

-- 
You received this message because you are subscribed to the Google Groups "[email protected]" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-tech-crypto/CAJeAr6sxa6AKa14RNeq2Us1CJTyipX3Ykowg164hNiY3ctnjrg%40mail.gmail.com.