While there are many ways to do point-to-point traffic encryption, leading members of the Linux NFS community have proposed a different, and simpler, strategy for achieving over-the-wire encryption of NFS traffic.

This solution relies on self-signed certificates to set up standard encryption for nfs over-the-wire traffic without the heavy overhead of Kerberos or Active Directory.

Most NFS works this way already: a tenant trusts the IP addresses provided by the DNS service, but does not trust the other tenants not to spy on the traffic.

While this solution would not be as full-featured as the user authentication solutions, this is a solution which would be useable with minimal configuration required by an administrator.

Someday this could mean that all NFS traffic would be transparently encrypted as this capability rolls out to NFS clients and servers.

Actually, your article inspired our idea, and you are credited in the Internet Draft.

Our proposal brings additional value: 1) better interoperability for storage appliances that might not want to permit broad ssh access; 2) nearly zero-configuration for clients, where administrative costs can multiply quickly; and 3) ability to offload TLS to hardware that can support it.

Forcing use the use of DTLS would be up to local security policy.

Will there be a kernel TLS implementation In Linux, we very much want to enable TLS in the kernel RPC implementation.

We will use whatever preferred TLS implementation is available in that environment, just like other kernel storage protocol implementations such as NVMe on TCP.

Nfs 4.1 Encryption