Reliable client-server connections Making Telnet secure Thijs - PowerPoint PPT Presentation

Reliable client-server connections Making Telnet secure Thijs Rozekrans Ren´ e Klomp thijs.rozekrans@os3.nl rene.klomp@os3.nl System and Network Engineering University of Amsterdam July 3, 2013 Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 1 / 16

Introduction • Authentication of both clients and servers • Decentralised • Based on TLS • Proof of concept Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 2 / 16

Introduction How can current techniques be used to validate the identity of both client and server, using a TLS connection, in a decentralised way? Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 3 / 16

Motivation • Increase usage of certificate by clients and servers • Eliminate the need for certificate authorities • Diginotar debacle • Foreign governments • Centralized • Techniques are available • Currently no implementations exist Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 4 / 16

Design considerations • PGP or X.509 (CA’s) • Validating certificates • Daemon or Library • Programming language Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 5 / 16

PGP or X.509 • X.509 • Widely adapted • Validation of certificate is done by CA • PGP • Certificates are managed by users • Decentralized design (web-of-trust) Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 6 / 16

Validating certificates Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 7 / 16

Daemon or Library • Library • Existing GnuTLS library • Daemon • Forwarding mechanism • Caching • Access to private keys • Multiple programming languages Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 8 / 16

Programming Language • Performance • Future extension Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 9 / 16

Implementation • Daemon • Python • PyGnuTLS Library • Pass file descriptor of existing connection Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 10 / 16

Implementation TCP Handshake Client Server Library Library Encrypted Daemon Daemon Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 11 / 16

Implementation • Based on certificate UID • LDAP • DANE • Flags to disable certain checks • DNSSEC • Reponds with: • OK + id • ERR + code + message Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 12 / 16

Implementation • Forwarding mechanism • Telnet application as an example • Possible with every other application TCP Handshake Telnet TCP-Forwarder TCP-Forwarder Telnetd Library Library Encrypted Daemon Daemon Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 13 / 16

Conclusion How can current techniques be used to validate the identity of both client and server using a TLS connection in a decentralised way? • By creating a daemon it is possible! • Easily implemented using single call to library • It does work with an existing application (Telnet) • https://github.com/OS3/rp2_68 Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 14 / 16

Future work • (D)TLS for UDP and SCTP • (Soft)HSM • Caching • Certificate Pinning • Libraries in other languages Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 15 / 16

Questions Are there any questions? made possible by Thijs Rozekrans, Ren´ e Klomp (UvA) Reliable client-server connections July 3, 2013 16 / 16