Part 2 - Key Generation - Secret and Authentic Channels
During Part 1 we setup and tested the Java
environment running a simple distributed system composed by a client and a
server.
Review
Task 0 and Task 1 if you do not
remember how to compile and run Java programs using the AnBxJ library.
We are working in this folder
To use the
scripts on this page, the environmental variables JAVA_HOME
and PATH must be set are described in
Task 0.
Download the following command files (they will help you to compile and run the programs):
- on Windows
- on Linux
After downloading these files, double check that the extension of is .cmd/.sh (sometimes the browser may change it to .cmd.txt)
TASK 1 - Key generation
We are going to create RSA (2048 bits) keypairs (private and public) for alice and
bob; keys will be stored on keystore of type PKCS12.
- create a folder keygen inside
- download the following files:
- on Windows
- on Linux, in order to execute the scripts you need
to change the permissions (e.g. chmod +x scriptname).
- open these files and look at the code. Identify the variables that set the agent's alias and keystore name and password
- run the following commands (after each one, look at the
content of the folder and see which files are created/updated)
use extension .sh if using the Linux scripts- keygen alice to create alice's keys
- keyexport alice to export alice's public key
- create now bob's keypair and export his public key
- keyimport alice bob to import bob's public key into alice's public keystores
- list the keys into alice keystores (when asked for the password
enter alicepassword - this is only for testing purpose)
- keytool -keystore alice_enc.public -list -v
- import alice's publickey into bob's public keystore
- run certexport alice to export alice's CSR (Certificate Signature Request)
- open the .csr file and check if it is valid
https://confirm.entrust.net/public/en - repeat the same for bob CSR
- You can repeat the same process to generate keys similarly to the
keystore folder described in the next task.
- For each agent, you will need to create 2 files for each key "type" (purpose): enc, sig, hmc, tls (it requires a simple adaptation of the above scripts).
- For each agent, create a .pwd file containing the keystores'
passwords. Default password: <alias>password, e.g. alicepassword
As a example follow the model used in the file alice.pwd.
TASK 2 - Configure the keystores for this tutorial
- download the file keystore.zip and expand it in the folder
- there is a
\keystore folder where you find several keystores
- each agent has private and public keystores (they contain RSA keys used for different purposes: enc, sig, hmc, tls)
- the file alice.pwd is the configuration file for alice keystores (keystores password are there)
TASK 3 - Exchanging encrypted messages (Secrecy)
- download, compile and run Tutorial_02.java (there is a server and client)
- run the client 3 times. reply with the following names "alice","bob" and
your name
- How do explain the behaviour of the program?
- try to modify the program in order to make the client to able to reply to the server with a secret message (the client needs to learn the server's name and to check if he possesses the server's public key)
TASK 4 - Digitally signing messages (Authentication)
- download, compile and run Tutorial_03.java (there is a server and client)
- run the client 3 times. reply with the following names "alice","bob" and
your name
- How do explain the behavior of the program?
- think on how to improve the program. Can the server check the incoming data? hint: look at (<servername>,<timestamp>) message
TASK 5 - (optional)
- try to build a program that combines task 3 and task 4 (a secret exchange followed by an authenticated exchange)
TASK 6 - (optional)
- try running these programs with the keys you created on task 1 (hint: you need to configure your keygen folder similarly to the keystore folder and create a config files (e.g. alice.pwd) for each agent.