[S] Change in openvpn[master]: Reduce number of future epoch keys from 16 to 4

Attention is currently required from: plaisthos.

plaisthos has uploaded a new patch set (#2). ( http://gerrit.openvpn.net/c/openvpn/+/1844?usp=email )


Change subject: Reduce number of future epoch keys from 16 to 4
......................................................................

Reduce number of future epoch keys from 16 to 4

The calculation in the RFC was wrong and probably influenced
by an older worst case assumption. With the fixed calculation
four future epoch keys should be more than enough even for
100 Gbit/s. So change the number to 4 in OpenVPN as well.

This also reduces the spam about the epoch keys a bit.

Thanks to Ralf Lici for noticing the wrong calculation.

Change-Id: Id3c6681b29026c2920a62a0ea570fd098649e197
Signed-off-by: Arne Schwabe <[email protected]>
---
M src/openvpn/ssl.c
1 file changed, 7 insertions(+), 3 deletions(-)


  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/44/1844/2

diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index fd96b85..81346d1 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1343,10 +1343,14 @@
 init_epoch_keys(struct key_state *ks, struct tls_multi *multi, const struct key_type *key_type,
                 bool server, struct key2 *key2)
 {
-    /* For now we hardcode this to be 16 for the software based data channel
+    /* For now we hardcode this to be 4 for the software based data channel
      * DCO based implementations/HW implementation might adjust this number
-     * based on their expected speed */
-    const uint8_t future_key_count = 16;
+     * based on their expected speed.
+     *
+     * One epoch lasts 910 GB with 128 byte packets or 78s at 100 GBit/s.
+     * (respectively 1011 GB and 86s with 1280 byte packets).
+     */
+    const uint8_t future_key_count = 4;
 
     int key_direction = server ? KEY_DIRECTION_INVERSE : KEY_DIRECTION_NORMAL;
     struct key_direction_state kds;

-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1844?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id3c6681b29026c2920a62a0ea570fd098649e197
Gerrit-Change-Number: 1844
Gerrit-PatchSet: 2
Gerrit-Owner: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-CC: razvanc <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel