Samba in love with GnuTLS Samba in love with GnuTLS SambaXP 2019 - - PowerPoint PPT Presentation

▶
samba in love with gnutls samba in love with gnutls
SMART_READER_LITE
LIVE PREVIEW

Samba in love with GnuTLS Samba in love with GnuTLS SambaXP 2019 - - PowerPoint PPT Presentation

Mar 17, 2024 263 likes •784 views

6/6/2019 Samba in love with GnuTLS Samba in love with GnuTLS Samba in love with GnuTLS SambaXP 2019 SambaXP 2019 Andreas Schneider Red Hat Samba Maintainer localhost:8000/?print-pdf#/ 1/51 6/6/2019 Samba in love with GnuTLS About me

slide-1
SLIDE 1

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 1/51

Samba in love with GnuTLS Samba in love with GnuTLS

SambaXP 2019 SambaXP 2019

Andreas Schneider

Red Hat Samba Maintainer

slide-2
SLIDE 2

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 2/51

About me About me

Free and Open Source Software Developer cmocka - a unit testing framework for C Samba - The domain controller and file server libssh - The SSH Library cwrap - Client/Server testing made easy LineageOS - Android with Privacy Features

slide-3
SLIDE 3

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 3/51

1 What is Samba? What is Samba?

slide-4
SLIDE 4

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 4/51

What is Samba? What is Samba?

Samba is the software that you probably curse a lot at.

slide-5
SLIDE 5

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 5/51

2 What is GnuTLS? What is GnuTLS?

slide-6
SLIDE 6

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 6/51

What is GnuTLS? What is GnuTLS?

GnuTLS is the software you will love after this talk.

slide-7
SLIDE 7

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 7/51

GnuTLS is ... GnuTLS is ...

Secure communication library for C Implements TLS protocol and sourrounding technology Mostly uses the nettle library for low level crypto Provides more hardware-accelerated implementation of different ciphers

slide-8
SLIDE 8

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 8/51

3 Why GnuTLS? Why GnuTLS?

slide-9
SLIDE 9

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 9/51

Why do we use GnuTLS? Why do we use GnuTLS?

Samba already uses GnuTLS for LDAP over TLS.

slide-10
SLIDE 10

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 10/51

Samba crypto Samba crypto

Samba implemented own crypto: SHA265, SHA512, HMAC-SHA256 MD5, MD4, HMAC-MD5 AES-CFB, AES-CCM, AES-GCM, AES-CMAC DES, RC4

slide-11
SLIDE 11

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 11/51

4 Why shouldn't you write your own crypto Why shouldn't you write your own crypto functions? functions?

slide-12
SLIDE 12

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 12/51

Why shouldn't you write your own crypto functions? Why shouldn't you write your own crypto functions?

Implementing crypto algorithms is relatively easy

  • 1. Preventing attacks on the implementation is hard
  • 2. Writing secure and performant code is hard

Watch devconf.cz 2019 talk from Simo: Why you shouldn't write crypto functions yourself

slide-13
SLIDE 13

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 13/51

Why Samba shouldn't write its own crypto? Why Samba shouldn't write its own crypto?

Samba developers aren't cryptographers

slide-14
SLIDE 14

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 14/51

5 SMB3 and encryption SMB3 and encryption

slide-15
SLIDE 15

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 15/51

Samba and AES-NI support Samba and AES-NI support

AES-NI is hardware support for AES ciphers AES-NI is available on most hardware nowadays e.g. x86, ARM, SPARC T3 Since Samba 4.8 we have support for Intel AES-NI

  • n x86_64
slide-16
SLIDE 16

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 16/51

SMB3 encryption with AES-CCM/AES-GCM SMB3 encryption with AES-CCM/AES-GCM

For SMB3 encryption: Windows prefers AES-GCM over AES-CCM Samba perfers AES-CCM over AES-GCM

slide-17
SLIDE 17

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 17/51

6 Numbers Numbers

slide-18
SLIDE 18

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 18/51

Lets send and receive 1 GB of random data over SMB3 with Lets send and receive 1 GB of random data over SMB3 with encryption encryption

slide-19
SLIDE 19

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 19/51

Hardware Hardware

CPU: i7-4960X CPU @ 3.60GHz (2013) RAM: 32GB Instruction Set: AES-NI support

slide-20
SLIDE 20

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 20/51

Send and receive 1 GB of random data over SMB3 Send and receive 1 GB of random data over SMB3

Client and server running at the same machine

time smbclient //LOCALSRV/tmp -mSMB3 -e \

  • c 'put 1GB.bin; get 1GB.bin /dev/null'
slide-21
SLIDE 21

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 21/51

SMB3 Encryption with AES-CCM SMB3 Encryption with AES-CCM

slide-22
SLIDE 22

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 22/51

Samba 4.10 (AES-CCM) Samba 4.10 (AES-CCM)

putting file 1GB.bin (46458.8 kb/s) (average 46458.8 kb getting file 1GB.bin (47832.1 kb/s) (average 47832.1 kb real 0m44.613s user 0m20.914s sys 0m3.623s

slide-23
SLIDE 23

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 23/51

Samba 4.10, AES-NI (AES-CCM) Samba 4.10, AES-NI (AES-CCM)

putting file 1GB.bin (88397.9 kb/s) (average 88397.9 kb getting file 1GB.bin (90668.0 kb/s) (average 90668.1 kb real 0m23.595s user 0m10.427s sys 0m3.694s

slide-24
SLIDE 24

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 24/51

Samba with GnuTLS, AES-NI (AES-CCM) Samba with GnuTLS, AES-NI (AES-CCM)

putting file 1GB.bin (106747.0 kb/s) (average 106747.0 getting file 1GB.bin (110901.7 kb/s) (average 110901.7 real 0m19.454s user 0m7.716s sys 0m4.484s

slide-25
SLIDE 25

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 25/51

SMB3 Encryption with AES-GCM SMB3 Encryption with AES-GCM

slide-26
SLIDE 26

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 26/51

Samba 4.10, AES-NI (AES-GCM) Samba 4.10, AES-NI (AES-GCM)

putting file 1GB.bin (3268.4 kb/s) (average 3268.4 kb/s getting file 1GB.bin (3240.0 kb/s) (average 3240.0 kb/s real 10m44.602s user 5m21.525s sys 0m3.820s

slide-27
SLIDE 27

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 27/51

Samba with GnuTLS, AES-NI (AES-GCM) Samba with GnuTLS, AES-NI (AES-GCM)

Speedup GCM: 50 times faster

putting file 1GB.bin (172010.5 kb/s) (average 172010.5 getting file 1GB.bin (183445.8 kb/s) (average 183445.8 real 0m12.299s user 0m3.883s sys 0m4.610s

slide-28
SLIDE 28

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 28/51

AES-CCM (Samba, AES-NI) vs AES-GCM (GnuTLS) AES-CCM (Samba, AES-NI) vs AES-GCM (GnuTLS)

AES-CCM (Samba 4.10): 23.454s (~90 MB/s) AES-GCM (GnuTLS): 12.299s (~180 MB/s) Speedup: Twice as fast

slide-29
SLIDE 29

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 29/51

Do you already start to love GnuTLS? Do you already start to love GnuTLS?

slide-30
SLIDE 30

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 30/51

Signing with AES-CMAC Signing with AES-CMAC

smbclient -mSMB3 --signing=required Samba crypto AES-NI: 0m15.239s Samba with GnuTLS: 0m14.833s nettle implemented AES-CMAC based on Samba's implementation.

slide-31
SLIDE 31

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 31/51

Signing with AES-GMAC (coming soon) Signing with AES-GMAC (coming soon)

Will be introduced by Microsoft to SMB3 soon. https:/ /gitlab.com/gnutls/gnutls/issues/781

slide-32
SLIDE 32

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 32/51

Next Hardware Next Hardware

slide-33
SLIDE 33

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 33/51

Hardkernel ODROID-N2 Hardkernel ODROID-N2

ARM Cortex-A73 CPU (4 + 2 cores Cortex-A53) ARM64 with AES-NI support 4GByte DDR4 RAM Bad IO (~ 17MB/s) => tmpfs (ramdisk) for Samba share

slide-34
SLIDE 34

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 34/51

SMB3 Encryption with AES-CCM SMB3 Encryption with AES-CCM

slide-35
SLIDE 35

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 35/51

Samba 4.10 (AES-CCM) Samba 4.10 (AES-CCM)

putting file 1GB.bin (13290.4 kb/s) (average 13290.4 kb getting file 1GB.bin (14952.5 kb/s) (average 14952.5 kb real 2m29.630s user 1m2.436s sys 0m20.992s

slide-36
SLIDE 36

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 36/51

Samba with GnuTLS (AES-CCM) Samba with GnuTLS (AES-CCM)

putting file 1GB.bin (12714.6 kb/s) (average 12714.6 kb getting file 1GB.bin (29526.5 kb/s) (average 29526.5 kb real 1m58.512s user 0m24.252s sys 0m25.140s

slide-37
SLIDE 37

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 37/51

SMB3 Encryption with AES-GCM SMB3 Encryption with AES-GCM

slide-38
SLIDE 38

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 38/51

Samba 4.10 (AES-GCM) Samba 4.10 (AES-GCM)

putting file 1GB.bin (1372.8 kb/s) (average 1372.8 kb/s getting file 1GB.bin (1370.0 kb/s) (average 1370.0 kb/s real 25m29.725s user 12m36.344s sys 0m13.868s

slide-39
SLIDE 39

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 39/51

Samba with GnuTLS (AES-GCM) Samba with GnuTLS (AES-GCM)

putting file 1GB.bin (23982.8 kb/s) (average 23982.8 kb getting file 1GB.bin (37530.9 kb/s) (average 37530.9 kb real 1m11.970s user 0m18.504s sys 0m23.932s

slide-40
SLIDE 40

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 40/51

AES-CCM (Samba, AES-NI) vs AES-GCM (GnuTLS) AES-CCM (Samba, AES-NI) vs AES-GCM (GnuTLS)

AES-CCM (Samba 4.10): 149s (~14 MB/s AES-GCM (GnuTLS): 71s (~37 MB/s) Speedup: Twice as fast

slide-41
SLIDE 41

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 41/51

Performance will be even better when we get which uses io vectors.

gnutls_aead_cipher_(en|de)crypt_vec()

https:/ /gitlab.com/gnutls/gnutls/issues/718

slide-42
SLIDE 42

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 42/51

7 Lets talk about FIPS Lets talk about FIPS

Heinz Erhardt: Ritter FIPS

slide-43
SLIDE 43

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 43/51

What is FIPS? What is FIPS?

Standard for Security Requirements for Cryptographic Modules by the US government Issued by the National Institute of Standards and Technology (NIST)

slide-44
SLIDE 44

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 44/51

What is FIPS 140-2? What is FIPS 140-2?

Set of requirements how to implement cryptography: Only use crypto algorithms and protocols only from a validated FIPS crypto library Ensure radom numbers are only coming from a validated FIPS crypto library

slide-45
SLIDE 45

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 45/51

What is FIPS 140-2? What is FIPS 140-2?

Set of requirements how to implement cryptography: Check whether only approved or allowed crypto algorithms are used for security relevant functionality Secret keys and other secret material must be zeroized once it is no longer used

slide-46
SLIDE 46

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 46/51

For FIPS mode: Kernel boots with a special command line option (fips=1) Or you set: echo 1 > /etc/system-fips Based on those option crytpo implementations

  • nly allow to use a certain set of ciphers and

hashes

slide-47
SLIDE 47

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 47/51

What does FIPS 140-2 mean for Samba? What does FIPS 140-2 mean for Samba?

RC4 and MD5 is not available

  • 1. NTLM doesn't work, only KRB5
  • 2. SMB1 doesn't work (only guest connections)
slide-48
SLIDE 48

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 48/51

8 Requriements Requriements

slide-49
SLIDE 49

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 49/51

Requirements for GnuTLS Requirements for GnuTLS

Minimum requirement: GnuTLS 3.2 For AES-GCM and AES-CCM: >= 3.4.7 For AES-CMAC and AES-CFB8: >= 3.6.5 For FIPS mode: >= 3.6.6

slide-50
SLIDE 50

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 50/51

Release? Release?

October 2019 - Samba 4.11

slide-51
SLIDE 51

6/6/2019 Samba in love with GnuTLS localhost:8000/?print-pdf#/ 51/51

GAME OVER GAME OVER