hesela.devNVMe/TCP digest
An NVMe/TCP digest is an optional CRC32C error-detection value protecting a protocol data unit's header or data after negotiation at connection establishment.
Coverage: Header and data digests are negotiated separately; padding is not protected by either [1].
Security boundary: CRCs can detect accidental alteration but cannot authenticate data against an attacker who can recompute the code [2].
Configuration: nvme-cli v2.11 provides distinct header-digest, data-digest and TLS options; a requested option is not by itself evidence of the negotiated connection state [3].
Relations
- related
- nvme-tcp, nvme-of, checksum, authenticated-encryption, end-to-end-data-protection
Citations
- NVM Express NVMe over TCP Transport 1.3, sections 2, 3.1, 3.2, 3.3.1.1 and 3.6
- RFC 3385, section 10: CRCs do not protect against intentional alteration
- nvme-cli v2.11: nvme-connect digest and TLS options
Sources & caveats
- Protocol scope: TCP Transport 1.3. No hardware error rate, cryptographic guarantee or end-to-end persistence result is inferred.