A simplified peer authenticator. More...

#include <DwmAuthPeerAuthenticator.hh>

Public Member Functions
	PeerAuthenticator (const std::string &myPrivKeyPath, const std::string &pubKeysPath)
	Construct from a path to our ed25519 private key and a path to a file containing public keys. More...

	PeerAuthenticator (const std::string &myId, const Ed25519::KeyPair &keyPair, const std::string &pubKeysPath)
	Construct from `myId` (normally an email address), a `keyPair` and a path to a public keys file. More...

bool	Authenticate (int fd, std::string &theirId, std::string &agreedKey)
	Authenticate the peer connected to the socket `fd`. More...

bool	Authenticate (boost::asio::ip::tcp::socket &s, std::string &theirId, std::string &agreedKey)

Detailed Description

A simplified peer authenticator.

This is a bit tricky under the hood like most security software, but also to reduce the number of TCP packets transmitted. I use ECDH to create a shared private key, which is then used to encrypt an identity. The encrypted identity and an SHA256 signature of the identity (signed using our RSA private key) and the public part of our ECDH exchange are transmitted to the peer. We receive the same from the peer. We decrypt the peer's identity and check that the signed message is valid by using the peer's public key contained in our public keys file. The peer does the same with our signed message.

Constructor & Destructor Documentation

◆ PeerAuthenticator() [1/2]

Dwm::Auth::PeerAuthenticator::PeerAuthenticator	(	const std::string &	myPrivKeyPath,
		const std::string &	pubKeysPath
	)

Construct from a path to our ed25519 private key and a path to a file containing public keys.

We expect the peer's ID (typically an email address) to be in the public keys file, along with their public key. If this object is constructed from a server, the public key file would typically be an "authorized_keys" file. If constructed from a client, the public key file would typically be a "known_services" files.

If myPrivKeyPath is empty, it is assumed to be "~/.dwmauth/id_ed25519". If pubKeysPath is empty, it is assumed to be "~/.dwmauth/known_services".

◆ PeerAuthenticator() [2/2]

Dwm::Auth::PeerAuthenticator::PeerAuthenticator	(	const std::string &	myId,
		const Ed25519::KeyPair &	keyPair,
		const std::string &	pubKeysPath
	)

Construct from myId (normally an email address), a keyPair and a path to a public keys file.

I need this on iOS where I store keys in the keychain instead of in plain files.

Member Function Documentation

◆ Authenticate()

bool Dwm::Auth::PeerAuthenticator::Authenticate	(	int	fd,
		std::string &	theirId,
		std::string &	agreedKey
	)

Authenticate the peer connected to the socket fd.

On success, returns true and fills theirId with the peer's identifier and agreedKey with the ECDH agreed shared key which can later be used for encryption. Returns false on failure. agreedKey should be 32 bytes in length on success.

The documentation for this class was generated from the following file: