Truledger Wire Encryption
I implemented encryption between the client and server in Truledger - The client requests a session:
(<id>,opensession,<serverid>,<req#>)
The server sends back a session ID and key, encrypted to the user's PGP public key:
(<serverid>,@opensession,(<id>,opensession,<serverid>,<req#>),<pubkey encrypted: [<sessionid>,<sessionkey>]>)
Further communication happens AES-128 encrypted with the sessionkey:
[<sessionid>,<iv>,<sessionkey encrypted: message>]
Where <iv>
is a random initialization vector, generated for each message, used for CBC.
Sessions expire after 5 minutes of inactivity or an hour total. I'll probably eventually make this a preference, and allow selection of AES-192 or AES-256 or Tempest in addition to AES-128.
The live server at truledger.com is now running this code, and I created new binaries including it at truledger.com/download.
This is the first use of our new pure-lisp crypto library. Soon, we'll have RSA and SHA1 in pure lisp, too, and I'll drop the dependence on the OpenSSL library.
Fixed new session thrashing
There was a minor problem with the initial implementation. When a session expired, getting the new session ate a REQ#. This caused any REQ# arg in the message the client was trying to send to fail. I changed the code to look for this, and auto-update the REQ# arg. Now it sends only one additional (opensession) message, instead of a slew of them to reinitialize the balances.
New binaries not yet made.
excellent
The code looks great!
Edit comment