Re: [PATCH 2/2] ksmbd: add AES-GMAC signing support

[Namjae Jeon]

On Wed, Nov 4, 2026 at 2:57 AM mixalhs <mike.michalo@xxxxxxxxx> wrote:
>
> Hi Ian,
> Thank you for the careful analysis and the reproducer.
>
> You’re right: in the multichannel branch of smb2_sess_setup() the binding
> request is never verified with Session.SigningKey, and with AES-GMAC t
> hat turns the existing signing oracle into nonce reuse.
> Namjae, please don’t apply this version. I was unaware of this.
> I’ll send a v2 that first verifies binding requests with the session signing
> key before they are processed or any response is signed with it, and
> check whether legitimate binding can also reuse a nonce under
> the session key.
Okay, I will check v2 patches.
Thanks!