Main Page | Modules | Data Structures | File List | Data Fields | Globals | Related Pages

The Authentication Library
[Helper Components]

This library creates a simple interface for server processes to authenticate clients by using public/private key encryption. More...


Files

file  auth_lib.c
 This is the implementation of the Authentication Library.

file  auth_lib.h
 This is the header for the Authentication Library.


Defines

#define AUTH_VALID_MESSAGE   "PASSED VERIFICATION"
#define AUTH_INVALID_MESSAGE   "FAILED VERIFICATION"
#define AUTH_PUB_KEY_FILE_EXT   ".pub"
#define AUTH_MAX_ENCR_MESS_LEN   8.0
#define AUTH_MAX_TEXT_LEN   257
#define AUTH_MAX_MSG_LEN   65536
#define AUTH_SOCK_TIMEOUT   10

Functions

int auth_server (int sock, char *pub_key_dir)
 A server process calls this function to authenticate clients that are using this library.

int auth_client (int sock, char *user_name, char *usr_priv_key)
 A client process calls this function to authenticate with a server using this library.


Detailed Description

This library creates a simple interface for server processes to authenticate clients by using public/private key encryption.

The process of creating a daemon requires a developer to make many difficult design decisions. One of these decisions is the choice of authentication methods. Most daemons are required to use authentication because they provide data that should only be accessible to select users. There are two major categories of authentication, symmetric and asymmetric. Symmetric authentication bases authentication on a secret shared between client and server. Suppling a password to an FTP server is an example of this. Both the server and the client have to keep track of the client's password, which is the secret. Asymmetric authentication allows the server to authenticate the client without sharing secrets. This method is more secure because there is no secret passing over lines of communication. Public/private key authentication uses this method.

Public/private key encryption is based on the principle that data encrypted with a client's public key can only be decrypted (in a reasonable amount of time) by that client's private key, and vice versa. This process also assumes that the private key is known by the client only.

In order to send a private message to a server, the client should encrypt the message with the server's public key, and then the server decrypts it with its private key.

To authenticate a client, a server sends it a challenge: a string of random bytes. The client then encrypts the challenge using its private key and sends the result back to the server. The server uses the client's public key to decrypt the message. If the resulting message matches the challenge; the client is authenticated.

Alsad provides an implementation of the process described above in the authentication library. The library is divided into two main functions, a server function and a client function. These functions are called by the client and server processes after a TCP connection has been established.

For the two functions of this library to work properly there is some initial setup that must occur. First, any client that the server needs to authenticate must have a public key file in pub_key_dir on the server that corresponds to the user_name supplied. The public key file on the server should be in the format:

<user_name>.pub

The naming convention for priv_key_file is not important because the variable specifies the full path. The public and private keys used in this library are read using the OpenSSL libraries. These libraries must be in place for the authentication library to compile. The library also expects the use of PEM format keys with no pass phrase. These keys are generated by typing the following commands at the shell:

openssl genrsa -out output_file 1024

This command creates a private key file output_file in PEM format that does not require a pass phrase and has a 1024-bit modulus.

In order to create the public key in PEM format, use the following command at the shell:

openssl rsa -in private_key_file -out output_file -pubout

This command will create the public key file output_file in PEM format from the private key found in private_key_file.


Define Documentation

#define AUTH_INVALID_MESSAGE   "FAILED VERIFICATION"
 

#define AUTH_MAX_ENCR_MESS_LEN   8.0
 

#define AUTH_MAX_MSG_LEN   65536
 

#define AUTH_MAX_TEXT_LEN   257
 

#define AUTH_PUB_KEY_FILE_EXT   ".pub"
 

#define AUTH_SOCK_TIMEOUT   10
 

#define AUTH_VALID_MESSAGE   "PASSED VERIFICATION"
 


Function Documentation

int auth_client int  sock,
char *  user_name,
char *  priv_key_file
 

A client process calls this function to authenticate with a server using this library.

Programmers should look over the detailed notes for this library to learn what is needed to use this function.

Parameters:
sock The socket descriptor used in communicating with the server process over the network.
user_name The user name that will be used by the server to determine which public key file to use.
priv_key_file The path to the client process's private key file.
Returns:
The function returns 0 on success and -1 on failure.
See also:
auth_server

int auth_server int  sock,
char *  pub_key_dir
 

A server process calls this function to authenticate clients that are using this library.

Programmers should look over the detailed notes for this library to learn what is needed to use this function.

Parameters:
sock A socket descriptor used in communicating with the client to authenticate.
pub_key_dir The path to the directory where all of the public keys for alsad are stored.
Returns:
The function returns 0 on success and -1 on failure.
See also:
auth_client


Generated on Thu Dec 16 23:07:32 2004 for alsad by doxygen 1.3.6