Re: [PATCH v4 2/6] ksmbd: sign with the negotiated SMB 3.1.1 signing algorithm

[Ian Bridges <icb@fastmail.org>]

Hi Michail,

On Tue, Nov 10, 2026 at 04:58:30PM +0000, Michail Andreas Michalopoulos wrote:
> Since connections of the same session can now use different
> algorithms, each signing key also has to be used with the algorithm it
> was created for. The session signing key belongs to the connection
> that set up the session, and MS-SMB2 3.3.5.5 requires a binding
> request on a new channel to be verified with it. Store that
> connection's algorithm in the session and use it together with the
> session key, while channel keys keep using their own connection's
> algorithm.

I don't think the spec ties the algorithm to the key. MS-SMB2 3.1.4.1
and 3.1.5.1 use Connection.SigningAlgorithmId, the algorithm of the
connection the message travels on. That holds for a binding request
too. The key is Session.SigningKey, but the algorithm is the one the
new connection negotiated.

The two algorithms also cannot differ for a client that follows the
spec. When it opens another connection to a server it is already
connected to, it offers only the algorithm it negotiated before
(3.2.4.2.2.2). ksmbd supports that algorithm, so it picks it again.

So sess->signing_algorithm looks unnecessary. Where the two could
differ, with a client that offers a different list on the new
connection, the patch verifies the binding request with the old
connection's algorithm, while the client signs it with the new one's.
Taking the algorithm from the connection, as the spec does, would
avoid that and the extra field.

Thanks,
Ian