au — Inferno 1ed

au

th, readauthinfo, writeauthinfo - authenticate a connection

include "sys.m";
include "keyring.m";
kr:= load Keyring Keyring->PATH;
auth: fn(fd: ref Sys->FD, info: ref Authinfo, setid: int)
                              : (string, array of byte);
readauthinfo: fn(filename: string)     : ref Authinfo;
writeauthinfo:fn(filename: string, info: ref Authinfo): int;

Description

auth (fd, info, setid)

The auth function performs mutual authentication over a network connection, usually between a client and a server. The auth function is symmetric, that is, each party runs it on their end of the connection. The Authinfo adt, info, contains the public key of a certifying authority (PKca), the private key of the user (SKu), the public key (PKu) of the user signed by the certifying authority (CERTu), and Diffie-Hellman parameters (alpha, p).

The auth function returns a string and a byte array. If the byte array is nil then the authentication has failed and the string is an error message. If the byte array is non-nil, then it represents a secret shared by the two communicating parties. In this case the string is the name of the party at the other end of the connection.

If the authentication is successful and the argument setid is non-zero then auth attempts to write the id of the party at the other end of the connection into /dev/user (see cons - console device in Chapter 2). No error is generated if this does not succeed. If the authentication is not successful and setid is non-zero, auth writes 'none' into /dev/user.

The authentication protocol is based on the Station-to-Station protocol. In the following the parties are labeled 0 and 1. Sig0(x) is x signed with 0's private key.

0 -> 1  alpha**r0 mod p, CERTu0, PKu0   
1 -> 0  alpha**r1 mod p, CERTu1, PKu1   
0 -> 1  sig0(alpha**r0 mod p, alpha**r1 mod p)   
1 -> 0  sig1(alpha**r0 mod p, alpha**r1 mod p)

At this point both 0 and 1 share the secret alpha**(r0*r1) which is returned in the byte array.

readauthinfo (filename)

The readauthinfo function reads an Authinfo adt from a file. It returns nil if there is a read or conversion error, a reference to the adt otherwise.

writeauthinfo (filename, info)

The writeauthinfo function writes an Authinfo adt to a file. It returns -1 if the write operation fails, 0 otherwise.

Files


/usr/<user>/keyring	The conventional directory for storing Authinfo files
/usr/<user>/keyring/default	The file normally used by server programs
/usr/<user>/keyring/$server	The files normally used by clients where $server is the network name of the server being called, for example, tcp!server_name

infernosupport@lucent.com

Museum

au — Inferno 1ed

au

Description

auth (fd, info, setid)

readauthinfo (filename)

writeauthinfo (filename, info)

Files