Uni/CSI-ES-2324
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[PD1] Added verification that server returns the correct client cert

Browse source
This commit is contained in:
Afonso Franco 2024-04-24 17:49:36 +01:00
parent 4f9312958d
commit 1d64590f33
Signed by: afonso
SSH key fingerprint: SHA256:aiLbdlPwXKJS5wMnghdtod0SPy8imZjlVvCyUX9DJNk
4 changed files with 47 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

35
Projs/PD1/internal/utils/cryptoUtils/cryptoUtils.go
View file

@ -69,6 +69,31 @@ func LoadKeyStore(keyStorePath string, password string) KeyStore {
return KeyStore{cert: cert, caCertChain: caCerts, privKey: privKey}
}
// Check if the cert is signed by the CA and is for the correct user
func (k KeyStore) CheckCert(cert *x509.Certificate, uid string) bool {
caCertPool := x509.NewCertPool()
for _, caCert := range k.caCertChain {
caCertPool.AddCert(caCert)
}
opts := x509.VerifyOptions{
Roots: caCertPool,
}
// Check if the certificate is signed by the specified CA
_, err := cert.Verify(opts)
if err != nil {
log.Println("Certificate not signed by a trusted CA")
return false
}
//Check if the pseudonym field is set to UID
oidMap := ExtractAllOIDValues(cert)
if oidMap["2.5.4.65"] != uid {
log.Println("Certificate does not belong to the message's receiver")
return false
}
return true
}
func (k *KeyStore) GetTLSConfig() *tls.Config {
certificate := tls.Certificate{Certificate: [][]byte{k.cert.Raw}, PrivateKey: k.privKey, Leaf: k.cert}
@ -93,8 +118,8 @@ func (k *KeyStore) GetServerTLSConfig() *tls.Config {
caCertPool.AddCert(caCert)
}
tlsConfig.ClientCAs = caCertPool
//FIX: SERVER ACCEPTS CONNECTIONS WITH UNMATCHING OR
// NO CERTIFICATE, NEEDS TO BE CHANGED SOMEHOW
//FIX: SERVER ACCEPTS CONNECTIONS WITH UNMATCHING OR
// NO CERTIFICATE, NEEDS TO BE CHANGED SOMEHOW
tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
return tlsConfig
}
@ -158,8 +183,8 @@ func (k KeyStore) EncryptMessageContent(receiverCert *x509.Certificate, content
// sign the message and append the signature
hashedContent := sha256.Sum256(content)
// NOTE: in this case the sign then encrypt method is used
// but should it be used over the encrypt then sign method?
// NOTE: in this case the sign then encrypt method is used
// but should it be used over the encrypt then sign method?
signature, err := rsa.SignPKCS1v15(nil, k.privKey, crypto.SHA256, hashedContent[:])
if err != nil {
log.Panicln("Could not create content signature: ", err)
@ -196,7 +221,7 @@ func (k KeyStore) DecryptMessageContent(senderCert *x509.Certificate, cipherCont
log.Panicln("Could not decrypt ciphertext: ", err)
}
// check signature with sender public key
signature, content:= unPair(contentAndSig)
signature, content := unPair(contentAndSig)
hashedContent := sha256.Sum256(content)
senderKey := senderCert.PublicKey.(*rsa.PublicKey)
if err := rsa.VerifyPKCS1v15(senderKey, crypto.SHA256, hashedContent[:], signature); err != nil {