lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]


This is not strictly speaking a Lua question per se, but rather a request for comment :)

I would like to simulate a public key infrastructure on the cheap for authentication purpose... for example, two applications communicate over SMTP and the server would like to authenticate the client...

My current thinking goes along the line of CRAM-MD5 or APOP, but with a twist: no shared secret.

(1) Upon a client connection, the server returns a random banner.
(2) The client identify itself with its host name and a signature. The signature being the random banner encrypted with the client private key. (3) To validate the signature, the server issues a callback to the client by looking up its address with a third party (e.g. DNS).

To generate random values, I use a mix of random, md5, uuid and crypto:

local aKey = md5.digest( aRandomValue )
local anUUID =
local aCipher = crypto.blowfish( aKey )
local aValue = aCipher( anUUID )

The above code generate a key by creating a digest of a random numeric value (a Mersenne Twister random number). It then create an UUID. And finally encrypt that UUID with the random digest using a blowfish cipher. This results in a 80 character long hex encoded key.

Signing a value goes like this:

local aCipher = crypto.blowfish( aKey )
local aKeyDigest = md5.digest( aKey )
local aValueDigest = md5.digest( aValue )
local aSignature = aCipher( aKeyDigest .. aValue .. aValueDigest )

This creates a cipher with a given key and then encrypt the value. The value is sandwiched between a key-value digest to add some noise (?) to it.

To validate a signature, the server call back the client with both the original banner value as well as the signature it has received. The client can then validate the signature by encrypting the value with its private key and see if it matches.

That's pretty much it.

Is such a scheme fatally flawed? Simple alternatives? Thoughts? Comments?

Thanks in advance :)


PA, Onnay Equitursay