|
libDwmAuth-0.1.0
|
 |
|
libDwmAuth-0.1.0
|
|
A simplified peer authenticator. More...
#include <DwmAuthPeerAuthenticator.hh>
Public Member Functions | |
| PeerAuthenticator (const std::string &myPrivKeyPath, const std::string &pubKeysPath) | |
| Construct from a path to our RSA private key and a path to a file containing public keys. More... | |
| bool | Authenticate (int fd, std::string &theirId, std::string &agreedKey) |
Authenticate the peer connected to the socket fd. More... | |
A simplified peer authenticator.
This is a bit tricky under the hood like most security software, but also to reduce the number of TCP packets transmitted. I use ECDH to create a shared private key, which is then used to encrypt a peer identifier. The encrypted peer identifier and an SHA256 signature of the encrypted peer identifier (signed using our RSA private key) and the public part of our ECDH exchange are transmitted to the peer. We receive the same from the peer. We decrypt the peers identifier and check that the signed message is valid by using the peers public key contained in our public keys file. The peer does the same with our signed message.
| Dwm::Auth::PeerAuthenticator::PeerAuthenticator | ( | const std::string & | myPrivKeyPath, |
| const std::string & | pubKeysPath | ||
| ) |
Construct from a path to our RSA private key and a path to a file containing public keys.
We expect the peer's ID (typically an email address) ot be in the public keys file, along with their public key. If this object is constructed from a server, the public key file would typically be an "authorized_keys" file. If constructed from a client, the public key file would typically be a "known_services" files.
| bool Dwm::Auth::PeerAuthenticator::Authenticate | ( | int | fd, |
| std::string & | theirId, | ||
| std::string & | agreedKey | ||
| ) |
Authenticate the peer connected to the socket fd.
On success, returns true and fills theirId with the peer's identifier and agreedKey with the ECDH agreed shared key which can later be used for encryption. Returns false on failure. agreedKey should be 32 bytes on success.
