matthias
/
iproute2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

man: add note to ip-macsec manual about necessary key management 

The man page of ip-macsec and the existance of the tool makes it seem like
the user could just configure static keys once, and be done with it. That is
not the case. Some form or key management must be done in user space.

Add a note about that.

Signed-off-by: Thomas Haller <thaller@redhat.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
This commit is contained in:
Thomas Haller 2019-09-25 12:24:03 +02:00 committed by Stephen Hemminger
parent 8d88c37724
commit 0d82ee9939
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
man/man8/ip-macsec.8
View File

@ -102,8 +102,19 @@ type.
.SS Display MACsec configuration
.nf
# ip macsec show
.SH NOTES
This tool can be used to configure the 802.1AE keys of the interface. Note that 802.1AE uses GCM-AES
with a initialization vector (IV) derived from the packet number. The same key must not be used
with the same IV more than once. Instead, keys must be frequently regenerated and distibuted.
This tool is thus mostly for debugging and testing, or in combination with a user-space application
that reconfigures the keys. It is wrong to just configure the keys statically and assume them to work
indefinitely. The suggested and standardized way for key management is 802.1X-2010, which is implemented
by wpa_supplicant.
.SH SEE ALSO
.br
.BR ip-link (8)
.BR wpa_supplicant (8)
.SH AUTHOR
Sabrina Dubroca <sd@queasysnail.net>