Truledger Wire Encryption

Submitted by Bill St. Clair on Sat, 04 Dec 2010 14:20:29 GMT  <== Truledger ==> 

I implemented encryption between the client and server in Truledger - The client requests a session:

(<id>,opensession,<serverid>,<req#>)

The server sends back a session ID and key, encrypted to the user's PGP public key:

(<serverid>,@opensession,(<id>,opensession,<serverid>,<req#>),<pubkey encrypted: [<sessionid>,<sessionkey>]>)

Further communication happens AES-128 encrypted with the sessionkey:

[<sessionid>,<iv>,<sessionkey encrypted: message>]

Where <iv> is a random initialization vector, generated for each message, used for CBC.

Sessions expire after 5 minutes of inactivity or an hour total. I'll probably eventually make this a preference, and allow selection of AES-192 or AES-256 or Tempest in addition to AES-128.

The live server at truledger.com is now running this code, and I created new binaries including it at truledger.com/download.

This is the first use of our new pure-lisp crypto library. Soon, we'll have RSA and SHA1 in pure lisp, too, and I'll drop the dependence on the OpenSSL library.

Add comment Edit post Add post

Comments (2):

excellent

Submitted by Patrick on Mon, 06 Dec 2010 03:24:18 GMT

The code looks great!

Edit comment

Fixed new session thrashing

Submitted by Bill St. Clair on Thu, 09 Dec 2010 13:37:40 GMT

There was a minor problem with the initial implementation. When a session expired, getting the new session ate a REQ#. This caused any REQ# arg in the message the client was trying to send to fail. I changed the code to look for this, and auto-update the REQ# arg. Now it sends only one additional (opensession) message, instead of a slew of them to reinitialize the balances.

New binaries not yet made.

Edit comment