Previous: , Up: Developer manual  


Handshake protocol

     ┌──────┐                                  ┌──────┐                         
     │Client│                                  │Server│                         
     └──┬───┘                                  └──┬───┘                         
        │────┐                                    │                             
        │    │ R=rand(64bit)                      │                             
        │<───┘                                    │                             
        │                                         │                             
        │────┐                                    │                             
        │    │ CPrivKey=rand(256bit)              │                             
        │<───┘                                    │                             
        │                                         │                             
        │   R, enc(PSK, R, CPubKey), xtea(ID, R)  │                             
        │ ────────────────────────────────────────>                             
        │                                         │                             
        │                                         │────┐                        
        │                                         │    │ SPrivKey=rand(256bit)  
        │                                         │<───┘                        
        │                                         │                             
        │                                         │────┐                        
        │                                         │    │ K=DH(SPrivKey, CPubKey)
        │                                         │<───┘                        
        │                                         │                             
        │                                         │────┐                        
        │                                         │    │ RS=rand(64bit)         
        │                                         │<───┘                        
        │                                         │                             
        │                                         │────┐                        
        │                                         │    │ SS=rand(256bit)        
        │                                         │<───┘                        
        │                                         │                             
        │ enc(PSK, R+1, SPubKey); enc(K, R, RS+SS)│                             
        │ <────────────────────────────────────────                             
        │                                         │                             
        │────┐                                    │                             
        │    │ K=DH(CPrivKey, SPubKey)            │                             
        │<───┘                                    │                             
        │                                         │                             
        │────┐                                    │                             
        │    │ RC=rand(64bit); SC=rand(256bit)    │                             
        │<───┘                                    │                             
        │                                         │                             
        │          enc(K, R+1, RS+RC+SC)          │                             
        │ ────────────────────────────────────────>                             
        │                                         │                             
        │                                         │────┐                        
        │                                         │    │ compare(RS)            
        │                                         │<───┘                        
        │                                         │                             
        │                                         │────┐                        
        │                                         │    │ MasterKey=SS XOR SC    
        │                                         │<───┘                        
        │                                         │                             
        │             enc(K, 0x00, RC)            │                             
        │ <────────────────────────────────────────                             
        │                                         │                             
        │────┐                                    │                             
        │    │ compare(RC)                        │                             
        │<───┘                                    │                             
        │                                         │                             
        │────┐                                    │                             
        │    │ MasterKey=SS XOR SC                │                             
        │<───┘                                    │                             
     ┌──┴───┐                                  ┌──┴───┐                         
     │Client│                                  │Server│                         
     └──────┘                                  └──────┘                         
  1. client generates CPubKey, random 64bit R that is used as a nonce for encryption, and an encrypted R with XTEA, where the key equals to client’s identity
  2. R + enc(PSK, R, CPubKey) + xtea(ID, R) + NULL + NULLs -> Server [65 bytes]
  3. server remembers clients address, decrypt CPubKey, generates SPrivKey/SPubKey, computes common shared key K (based on CPubKey and SPrivKey), generates 64bit random number RS and 256bit random SS. PSK-encryption uses incremented R (from previous message) for nonce
  4. enc(PSK, SPubKey) + enc(K, RS + SS) + NULLs -> Client [88 bytes]
  5. client decrypt SPubKey, computes K, decrypts RS, SS with key K, remembers SS, generates 64bit random number RC and 256bit random SC,
  6. enc(K, RS + RC + SC) + NULLs -> Server [64 bytes]
  7. server decrypt RS, RC, SC with key K, compares RS with it’s own one send before, computes final main encryption key S = SS XOR SC
  8. ENC(K, RC) + NULLs -> Client [24 bytes]
  9. server switches to the new client
  10. client decrypts RC and compares with it’s own generated one, computes final main encryption key S

Where PSK is 256bit pre-shared key, NULLs are 16 null-bytes. R* are required for handshake randomization and two-way authentication. K key is used only during handshake. NULLs are required to differentiate common transport protocol messages from handshake ones. DH public keys can be trivially derived from private ones.


Previous: , Up: Developer manual