NVMe-oF Authentication and TLS Keyring Helpers
Shared code that handles in-band authentication (DH-HMAC-CHAP) and TLS pre-shared key management for NVMe over Fabrics, the modern protocol for accessing flash storage arrays across a network. It is used by both the host and target sides of NVMe/TCP to negotiate cryptographic credentials when Linux servers talk to enterprise storage from vendors like NetApp, Oracle, and others.
recommendation
It should stay because this is actively developed code underpinning a current, ratified storage standard. Upstream commits land regularly (most recently November 2025), a 2024 patch series added secure concatenation support, and the 2025 NVMe/TCP 1.2 specification along with shipping products from Oracle and NetApp all rely on exactly this functionality.
repository signals
sources
- lwn.net
August 13, 2024 upstream patch series 'nvme: implement secure concatenation' touches drivers/nvme/common/auth.c and keyring.c, showing active feature development rather than retirement.
- nvmexpress.org
The ratified 2025 NVMe/TCP spec still requires/supports PSK with (EC)DHE and describes configured/generated TLS PSKs derived from NVMe authentication, so this functionality remains current in the standard.
- blogs.oracle.com
Oracle's July 11, 2025 article describes shipping kernel support for NVMe in-band authentication and NVMe-TLS for NVMe/TCP, indicating contemporary deployment interest.
- docs.netapp.com
NetApp ONTAP documentation dated December 16, 2025 documents configuring TLS secure channels for NVMe/TCP, showing current commercial product support.
codex reasoning notes (technical)
This is a real driver/module directory: Kconfig/Makefile build nvme-auth and nvme-keyring from auth.c and keyring.c, and the files carry MODULE_DESCRIPTIONs. Local source inspection via shell showed active NVMe auth/keyring code; provided static history already shows 28 substantive commits in 5y and a latest touch on 2025-11-20, which is incompatible with deprecation. Lore-specific shell tooling was unavailable here (lei missing; no lore MCP server exposed), so I checked upstream discussion via web search: LWN mirrored a 2024 kernel mailing-list patchset adding secure-concatenation work directly in this directory, and I found no removal/deprecation thread. Deployment evidence came from web search on the ratified NVMe/TCP 1.2 spec plus current Oracle and NetApp docs. Conclusion: active upstream, tied to still-current NVMe/TCP security features, so keep.