google / psp Goto Github PK

The specification claims that TCP with ISN randomization and PAWS provides good replay protection, but gives no proof.

64-bit SPIs would dramatically simplify implementations, at least inasmuch as they avoid needing premature key rotations.

Hi
is there any utilitity (like strongswan for esp) which can be used to test PSP between two hosts? Is there any linux kernel that supports PSP?

Thank you

Dear teachers
I am a follower of this project. I have a problem recently. I read the chapter of Key Derivation , but I don't quite understand how to generate secret keys for a psp stream. Could you please tell me the detail of initial handshaking ？

I didn't see any mention of the AAD format in the spec. I think it should be added.
Looking at the code I see the AAD is the entire PSP header plus any non-encrypted bytes (i.e., based on the crypt offset).

I can't use neper to test psp at first. Then I use command sudo ethtool -k ens33 | grep psp to check my interface config.
It shows :
tx-tcp-psp-segmentation: off [fixed] psp-ip: off [fixed]
And I tried to turn them on using sudo ethtool -K ens33 psp-ip on.
Then it showed :
Actual changes: psp-ip: off [requested on] Could not change any device features
Is this because my Nic doesn't support PSP?

A standard API for on-NIC firmware implementing PSP to coordinate with the host would be useful, as it would reduce the amount of hardware-specific driver code.

It is unclear how an SPI can last longer than the underlying master key in the NIC. In particular, there must be a way for receiver-side software to communicate new keys to the sender, and for there to be enough overlap (where both new and old keys are allowed) to avoid packet drops.