EMC® VNX® Series Security Configuration Guide for VNX

SMB encryption and signing

VNX for file/unified systems support of SMB 3.0 and Windows 2012 includes encrypting CIFS traffic on the network. This encryption of data in transit provides end-to-end encryption of all SMB data and requests sent between the CIFS server and the client system and protects these exchanges from eavesdropping or snooping attacks on the network.

SMB encryption can be configured per share or for each CIFS or Virtual Data Mover (VDM) CIFS server. Once a share is defined as encrypted, any SMB3 client must encrypt all its requests related to the share; otherwise, access to the share will be denied.

To enable SMB encryption, you either set the encryption through the server_export command or set it through the registry of the CIFS server. There is no setting required on the SMB client.

A new type option, Encrypted, has been added to the server_export command. If you set this option, it indicates that the server requires encrypted messages for accessing the CIFS share. For example, to create a share "share10" that is accessible only through encrypted SMB messages, type server_export vdm1 -P cifs -name share10 -o type=Encrypted /fs42/protected_dir1.

For encrypting all shares at the CIFS/VDM CIFS server level, new values, EncryptData and RejectUnencryptedAccess, have been added into the CIFS server registry (at HKEY_LOCAL_MACHINE > System > CurrentControlSet > Services > LanmanServer > Parameters).

Incoming traffic and outgoing traffic are encrypted using two different secret keys. Both are computed once the user is authenticated successfully. The encryption and decryption 16-bytes keys are generated using the Key Derivation Function (KDF) algorithm in Counter Mode. SMB messages on the network are encrypted between the client and server using the AES128-CCM cryptographic algorithm. Any SMB2 message can be encrypted, except SMB2_NEGOTIATE and SMB2_SESSION_SETUP.

SMB also provides data integrity validation (signing). This mechanism ensures that packets have not been intercepted, changed, or replayed. SMB signing adds a signature to every packet and guarantees that a third party has not changed the packets. When signed, the SMB2 messages contained in the SMB2_HEADER buffer a 16-bytes signature that guarantees the integrity of the message. If SMB3 is negotiated, the sender must compute a 16-byte hash using the AES128-CCM cryptographic algorithm over the entire message, beginning with the SMB2 Header and using the signing key. The signing key is generated using the KDF algorithm in Counter Mode. The Pseudo Random Function (PRF) used in the key derivation must be HMAC-SHA256. The SMB signing policy can be changed through Global Policy Objects (GPOs) or Windows Registry settings.