Re: Breakage in ktls-utils with nfs keyring?

On 5/4/26 10:02, Sagi Grimberg wrote:
>>>> This is because handling an NVMe PSK in the keyring is a first-class,
>>>> supported mechanism. Handling the x.509 certificate this way hasn't
>>>> really been thought through.
>>> What makes NVMe PSK more "supported" than x.509?
>> Hannes contributed NVMe PSK in the beginning. IIUC PSK was the first
>> authentication mode available for the NVMe/TCP protocol. I'm not sure
>> we can say that x.509 is supported for our NVMe/TCP implementation,
>> though that is something that should be made to work someday.
> 
> That depends if NVMe standardizes x.509, I am no longer a member of
> the TWG so I don't know, but I agree that it would be very nice to have.
> 
Sadly, this has been shelved for now.
There are no takers to move things forward.
So we're stuck with PSK for the time being.

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
[email protected]                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich