[PATCH] tipc: prevent GCM nonce reuse on peer key changes

[PATCH] tipc: prevent GCM nonce reuse on peer key changes

[Jérémy Jean]

TIPC can encrypt traffic between nodes using a different transmit key
for each node. In this mode, the AES-GCM nonce for a packet sent to a
known peer consists of a 32-bit prefix (a per-key salt XOR the peer's
address) followed by a 64-bit counter. That counter is stored in the
peer's RX crypto object. When the peer reports a change in which key
it uses to receive packets, TIPC resets this counter. The sender can
still be using the same TX key and salt, so subsequent packets reuse
earlier nonces. This nonce reuse breaks confidentiality and exposes
GCM's authentication key. This makes forgeries trivial: an attacker
can exploit CTR malleability to alter captured ciphertexts and use the
recovered authentication key to compute a valid tag for the modified
ciphertext, under the same key and nonce.

Use the TX key's existing aead->seqno counter instead. All encryptions
using that key object share the same atomic counter, so concurrent
encryptions get distinct nonce counter values. The counter survives
key activation and peer reconnection, and peer key-status reports
cannot reset it. This prevents those transitions from causing nonce
reuse while the same TX key remains installed.

The nonce format is unchanged, and receivers do not require consecutive
counter values, so sharing the counter across peers remains compatible
with existing receivers. A pre-existing check still invokes key
revocation in the unlikely event that the counter wraps to zero.

Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 net/tipc/crypto.c | 20 +++++---------------
 1 file changed, 5 insertions(+), 15 deletions(-)

diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
index 16f1ed1..4409bdb 100644
--- a/net/tipc/crypto.c
+++ b/net/tipc/crypto.c
@@ -144,7 +144,7 @@ struct tipc_tfm {
  * @rcu: struct rcu_head
  * @key: the aead key
  * @gen: the key's generation
- * @seqno: the key seqno (cluster scope)
+ * @seqno: the per-key TX nonce counter
  * @refcnt: the key reference counter
  */
 struct tipc_aead {
@@ -190,7 +190,6 @@ struct tipc_crypto_stats {
  * @rekeying_intv: rekeying interval (in minutes)
  * @stats: the crypto statistics
  * @name: the crypto name
- * @sndnxt: the per-peer sndnxt (TX)
  * @timer1: general timer 1 (jiffies)
  * @timer2: general timer 2 (jiffies)
  * @working: the crypto is working or not
@@ -219,7 +218,6 @@ struct tipc_crypto {
 	struct tipc_crypto_stats __percpu *stats;
 	char name[48];
 
-	atomic64_t sndnxt ____cacheline_aligned;
 	unsigned long timer1;
 	unsigned long timer2;
 	union {
@@ -1051,14 +1049,11 @@ static int tipc_ehdr_build(struct net *net, struct tipc_aead *aead,
 	WARN_ON(skb_headroom(skb) < ehsz);
 	ehdr = (struct tipc_ehdr *)skb_push(skb, ehsz);
 
-	/* Obtain a seqno first:
-	 * Use the key seqno (= cluster wise) if dest is unknown or we're in
-	 * cluster key mode, otherwise it's better for a per-peer seqno!
+	/*
+	 * Keep the nonce unique for the lifetime of the TX key,
+	 * including key state changes and peer reconnection.
 	 */
-	if (!__rx || aead->mode == CLUSTER_KEY)
-		seqno = atomic64_inc_return(&aead->seqno);
-	else
-		seqno = atomic64_inc_return(&__rx->sndnxt);
+	seqno = atomic64_inc_return(&aead->seqno);
 
 	/* Revoke the key if seqno is wrapped around */
 	if (unlikely(!seqno))
@@ -1237,7 +1232,6 @@ void tipc_crypto_key_flush(struct tipc_crypto *c)
 	tipc_crypto_key_set_state(c, 0, 0, 0);
 	for (k = KEY_MIN; k <= KEY_MAX; k++)
 		tipc_crypto_key_detach(c->aead[k], &c->lock);
-	atomic64_set(&c->sndnxt, 0);
 	spin_unlock_bh(&c->lock);
 }
 
@@ -1384,8 +1378,6 @@ done:
  * It also considers if peer has no key, then we need to make own master key
  * (if any) taking over i.e. starting grace period and also trigger key
  * distributing process.
- *
- * The "per-peer" sndnxt is also reset when the peer key has switched.
  */
 static void tipc_crypto_key_synch(struct tipc_crypto *rx, struct sk_buff *skb)
 {
@@ -1436,7 +1428,6 @@ static void tipc_crypto_key_synch(struct tipc_crypto *rx, struct sk_buff *skb)
 		if (cur)
 			tipc_aead_users_dec(tx->aead[cur], 0);
 
-		atomic64_set(&rx->sndnxt, 0);
 		/* Mark the point TX key users changed */
 		tx->timer1 = jiffies;
 
@@ -1501,7 +1492,6 @@ int tipc_crypto_start(struct tipc_crypto **crypto, struct net *net,
 	tipc_crypto_key_set_state(c, 0, 0, 0);
 	atomic_set(&c->key_distr, 0);
 	atomic_set(&c->peer_rx_active, 0);
-	atomic64_set(&c->sndnxt, 0);
 	c->timer1 = jiffies;
 	c->timer2 = jiffies;
 	c->rekeying_intv = TIPC_REKEYING_INTV_DEF;
-- 
2.47.3

RE: [PATCH] tipc: prevent GCM nonce reuse on peer key changes

[Tung Quang Nguyen]

>Subject: [PATCH] tipc: prevent GCM nonce reuse on peer key changes
>
>TIPC can encrypt traffic between nodes using a different transmit key for each
>node. In this mode, the AES-GCM nonce for a packet sent to a known peer
>consists of a 32-bit prefix (a per-key salt XOR the peer's
>address) followed by a 64-bit counter. That counter is stored in the peer's RX
>crypto object. When the peer reports a change in which key it uses to receive
>packets, TIPC resets this counter. The sender can still be using the same TX key
>and salt, so subsequent packets reuse earlier nonces. This nonce reuse breaks
>confidentiality and exposes GCM's authentication key. This makes forgeries
>trivial: an attacker can exploit CTR malleability to alter captured ciphertexts
>and use the recovered authentication key to compute a valid tag for the
>modified ciphertext, under the same key and nonce.
>
>Use the TX key's existing aead->seqno counter instead. All encryptions using
>that key object share the same atomic counter, so concurrent encryptions get
>distinct nonce counter values. The counter survives key activation and peer
>reconnection, and peer key-status reports cannot reset it. This prevents those
>transitions from causing nonce reuse while the same TX key remains installed.
>
>The nonce format is unchanged, and receivers do not require consecutive
>counter values, so sharing the counter across peers remains compatible with
>existing receivers. A pre-existing check still invokes key revocation in the
>unlikely event that the counter wraps to zero.
>
>Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
>Assisted-by: LLM
>Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
>

Next time, please add 'net' to [PATCH] for bug fix.

Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>

Re: [PATCH] tipc: prevent GCM nonce reuse on peer key changes

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 24 Sep 2026 20:21:05 +0000 you wrote:
> TIPC can encrypt traffic between nodes using a different transmit key
> for each node. In this mode, the AES-GCM nonce for a packet sent to a
> known peer consists of a 32-bit prefix (a per-key salt XOR the peer's
> address) followed by a 64-bit counter. That counter is stored in the
> peer's RX crypto object. When the peer reports a change in which key
> it uses to receive packets, TIPC resets this counter. The sender can
> still be using the same TX key and salt, so subsequent packets reuse
> earlier nonces. This nonce reuse breaks confidentiality and exposes
> GCM's authentication key. This makes forgeries trivial: an attacker
> can exploit CTR malleability to alter captured ciphertexts and use the
> recovered authentication key to compute a valid tag for the modified
> ciphertext, under the same key and nonce.
> 
> [...]

Here is the summary with links:
  - tipc: prevent GCM nonce reuse on peer key changes
    https://git.kernel.org/netdev/net/c/512ccd3d0e91

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html