Login module - communicate with certificate authority

include "keyring.m";
include "security.m";
lg:= load Login Login->PATH;
Login: module 
{
	PATH:	con "/dis/lib/login.dis";
	DHrandlen:	con 512; # size of random number 

for dh exponent
	PKmodlen:	con 512; # size in bits of modulus 

for public keys
	DHmodlen:	con 512; # size in bits of modulus 

for diffie hellman
	init: fn(): string;
	chello: fn(id, agreefile: string, 

c: ref Sys->Connection): 
		(ref Sys->Connection, string);
	ckeyx: fn(id, passwd: string, c: ref Sys->Connection):

		(ref Keyring->Authinfo, string);
	shello: fn(agreefile: string, c: ref Sys->Connection):

		(ref Password->PW, string);
	skeyx: fn(pw: ref Password->PW, info: 

ref Keyring->Authinfo, c: ref Sys->Connection):

		(ref Keyring->Authinfo, string);
	defaultsigner: fn(): string;
	signerkey: fn(file: string): 

(ref Keyring->Authinfo, string);
};

Description

The Login module provides routines to communicate with a Certifying Authority (CA) in order to create a Keyring->Authinfo adt. It does this assuming a password has already been established between the user and the CA.

The password is used by the encrypted key exchange protocol described in this section to establish a secure channel between the user and CA. The description uses the following notation:

ivec an 8 - byte random number chosen for this conversation

sha the 20 - byte secure hash (SHA-1) of the password

key an 8 - byte secret formed as follows: key[0] = ivec[0]^sha[0]^sha[8]^sha[16] key[1] = ivec[1]^sha[1]^sha[9]^sha[17] ... key[5] = ivec[5]^sha[5]^sha[13]; key[6] = ivec[6]^sha[6]^sha[14]; key[7] = ivec[7]^sha[7]^sha[15];

alpha a Diffie-Hellman base used system wide

p a Diffie-Hellman modulus used system wide

key (m) m encrypted using the RC4 algorithm with key

Rx a random number of the same order as p

secret the Diffie-Hellman secret alpha**(r0*r1) mod p

ivec	an 8 - byte random number chosen for this conversation
sha	the 20 - byte secure hash (SHA-1) of the password
key	an 8 - byte secret formed as follows: key[0] = ivec[0]^sha[0]^sha[8]^sha[16] key[1] = ivec[1]^sha[1]^sha[9]^sha[17] ... key[5] = ivec[5]^sha[5]^sha[13]; key[6] = ivec[6]^sha[6]^sha[14]; key[7] = ivec[7]^sha[7]^sha[15];
alpha	a Diffie-Hellman base used system wide
p	a Diffie-Hellman modulus used system wide
key (m)	m encrypted using the RC4 algorithm with key
Rx	a random number of the same order as p
secret	the Diffie-Hellman secret alpha(r0r1) mod p*

In the following protocol, the notation user --> CA xxx means that a user sends the message xxx to the certifying authority (CA). At any point in the exchange, either party can send an error instead of a message to terminate the protocol.

user --> CA  name   
CA --> user  ACK
     
user --> CA  ivec   
CA --> user  key(alpha**r0 mod p), alpha, p

user --> CA  alpha**r1 mod p
CA --> user  CA's public key, SHA(CA's public key + secret)

user --> CA  user's public key, SHA(user's public key + 
secret)
CA --> user  user's public key certificate

The complexity of this protocol is intended to shield the password. To start a clear text attack against the password, one needs to first attack the Diffie-Hellman exponential to determine alpha**r0 mod p.

The values alpha and p are sent unprotected, though the user code does a few sanity checks on the values it receives.

The role of ivec is to foil any replay attacks by someone spoofing the CA.

init ()

init: fn(): string;

## returns nil on success; error message on failure.

The init function loads the modules required by other Login module functions.

defaultsigner ()

defaultsigner: fn(): string;

The defaultsigner function returns the default signer server name from the file /services/cs/db.

signerkey (file)

signerkey: fn(file: string): 

(ref Keyring->Authinfo, string);

## returns (nil, error message) on failure.

The signerkey function retrieves the signer's authentication information from file and returns a tuple. If there is an error reading file or the certificate has expired, the tuple contains (nil, <error message>). If signerkey is successful, it returns a reference to a Keyring->Authinfo adt and a nil error message.

chello (id, agreefile, c)

chello: fn(id, agreefile: string, c: ref Sys->Connection): 

(ref Sys->Connection, string);

## returns (nil, error message) on failure.

The chello function sends the user id through an open connection and, if valid, gets an agreement. If successful, chello returns a ref connection and a nil error message.

shello (agreefile, c)

shello: fn(agreefile: string, c: ref Sys->Connection):

(ref Password->PW, string);

## returns (nil, error message) on failure.

The shello function gets the user id from an open connection and checks it against the password file. If valid, shello sends an agreement, waits for acknowledgement, and proceeds if the user agrees returning a ref Password->PW and a nil error message.

ckeyx (id, passwd, c)

ckeyx: fn(id, passwd: string, c: ref Sys->Connection):

(ref Keyring->Authinfo, string);

## returns (nil, error message) on failure.

The ckeyx function gets a certificate for a client.

skeyx (pw, info, c)

skeyx: fn(pw: ref Password->PW, info: 

ref Keyring->Authinfo, c: ref Sys->Connection):

(ref Keyring->Authinfo, string);

## returns (nil, error message) on failure.

The skeyx function creates and sends a certificate on an open connection.