[Openvpn-devel] [S] Change in openvpn[master]: Reduce number of future epoch keys from 16 to 4

Attention is currently required from: razvanc.

plaisthos has uploaded a new patch set (#4). ( http://gerrit.openvpn.net/c/openvpn/+/1844?usp=email )


Change subject: Reduce number of future epoch keys from 16 to 4
......................................................................

Reduce number of future epoch keys from 16 to 4

The calculation in the RFC was wrong and probably influenced
by an older worst case assumption. With the fixed calculation
four future epoch keys should be more than enough even for
100 Gbit/s. So change the number to 4 in OpenVPN as well.

This also reduces the spam about the epoch keys a bit.

Thanks to Ralf Lici for noticing the wrong calculation.

Change-Id: Id3c6681b29026c2920a62a0ea570fd098649e197
Signed-off-by: Arne Schwabe <[email protected]>
---
M src/openvpn/crypto_epoch.c
M src/openvpn/ssl.c
2 files changed, 11 insertions(+), 6 deletions(-)


  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/44/1844/4

diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c
index 54225bf..37933a1 100644
--- a/src/openvpn/crypto_epoch.c
+++ b/src/openvpn/crypto_epoch.c
@@ -308,9 +308,10 @@
         free_key_ctx(&co->key_ctx_bi.encrypt);
 
         /* Update the epoch_key for send to match the current key being used.
-         * This is a bit of extra work but since we are a maximum of 16
-         * keys behind, a maximum 16 HMAC invocations are a small price to
-         * pay for not keeping all the old epoch keys around in future_keys
+         * This is a bit of extra work but since we are a maximum of
+         * epoch_data_keys_future_count keys behind (4 by default),
+         * a maximum 4 HMAC invocations are a small price to pay for not
+         * keeping all the old epoch keys around in future_keys
          * array */
         while (co->epoch_key_send.epoch < new_epoch)
         {
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index fd96b85..01e45fd 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1343,10 +1343,14 @@
 init_epoch_keys(struct key_state *ks, struct tls_multi *multi, const struct key_type *key_type,
                 bool server, struct key2 *key2)
 {
-    /* For now we hardcode this to be 16 for the software based data channel
+    /* For now we hardcode this to be 4 for the software based data channel
      * DCO based implementations/HW implementation might adjust this number
-     * based on their expected speed */
-    const uint8_t future_key_count = 16;
+     * based on their expected speed.
+     *
+     * One epoch lasts 910 GiB with 128 byte packets or 78s at 100 GBit/s.
+     * (respectively 1011 GiB and 86s with 1280 byte packets).
+     */
+    const uint8_t future_key_count = 4;
 
     int key_direction = server ? KEY_DIRECTION_INVERSE : KEY_DIRECTION_NORMAL;
     struct key_direction_state kds;

-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1844?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id3c6681b29026c2920a62a0ea570fd098649e197
Gerrit-Change-Number: 1844
Gerrit-PatchSet: 4
Gerrit-Owner: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-CC: razvanc <[email protected]>
Gerrit-Attention: razvanc <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel