modothprav/secure-channel-java

A Java Secure Channel implementation that uses elements from the Java Cryptography Extension.

Secure Channel Echo Server and Client

The objective of this project was to implement a secure communications channel. Asymmetric encryption, signatures and key management in Java will be utilised to implement a secure protocol.

The project is divided into three sections, with each section built on top of the previous solution. The first section introduces asymmetric encryption, the second introduces key management and finally the third combines the previous two to implement a secure protocol.

The project consists of an Echo Server and a Client program. The server will just echo back the messages recieved back to the client. Howerver, the messages that are passed over the communication channel will be encrypted.

How to run

Section One: Asymmetric Encryption

Step 1: Navigate to src

Open two terminals and nivigate to the the src folder of the project in both of the terminals.

cd src

Step 2: Compilation

Compile the following files in one of the terminal sessions.

javac Part1/EchoServer.java Part1/EchoClient.java Part1/Util.java

Step 3: Run Client and Server Program

Run the server program on one terminal and client program on the other

java Part1.EchoServer

java Part1.EchoClient

The following output should be observed

Step 4: Exchange Public Keys

First paste the Client Public key onto the server's terminal and press enter so the server starts listenning for connections. Then paste the Server public key onto the client's terminal.

Step 4: Send Messages

Once the Server Public key is pasted onto the client's terminal, press enter to prompt the client to send messages to the server.

The following output should be observerd.

Section Two: Key management

The keys were generated using the keytool command which comes with the JCE. The client and server keys were created with same key password for testing purposes. The following commands shown below were used to generate the keys.

keytool -genkey -alias client -keyalg RSA -keystore cybr372.jks -storepass badpassword -keypass password -storetype JKS

keytool -genkey -alias server -keyalg RSA -keystore cybr372.jks -storepass badpassword -keypass password -storetype JKS

Step 1: Navigate to src

Open two terminals and nivigate to the the src folder of the project in both of the terminals.

cd src

Step 2: Compilation

Compile the following files in one of the terminal sessions.

javac Part2/EchoServer.java Part2/EchoClient.java Part2/Util.java

Step 3: Run Program

java Part2.EchoServer <storePassword> <keyPassword>

java Part2.EchoClient <storePassword> <keyPassword>

Run the server program on one terminal and the client program on the other. Will also have to specify the store password (badpassword) and the key password.

Note: Ensure that the server program is run first so it's listening for incoming connections.

The following output should be observed.

Section Three: Secure Channel

This sections uses asymmetric encryption for messages regarding key negotiation and once the symmetric keys are generated, symmetric encryption will be used for future messages. This continues until a max message limit is reached where key negotiation occurs again if there are more messages to be sent and received.

Step 1: Navigate to src

Open two terminals and nivigate to the the src folder of the project in both of the terminals.

cd src

Step 2: Compilation

Compile the following files in one of the terminal sessions.

javac Part3/EchoServer.java Part3/EchoClient.java Part3/Util.java

Step 3: Run Program

java Part3x.EchoServer <storePassword> <keyPassword> [maxMessages]

java Part3.EchoClient <storePassword> <keyPassword>

Run the server program on one terminal and the client program on the other. Will also have to specify the store password (badpassword) and the key password. The key password for both the client and server is password, for simplicity and testing purposes.

When running the server program, the user can also specify the number of maximum messages that can be received before key negotiation has to be performed again. If not specified this value will be set to 5.

Note: Ensure that the server is ran first and listening for connections.

The following output should be observed.

secure-channel-java's Issues

Update Readme instructions for Part One

Decrypt messages received from the destination (i.e. server to client and client to server)

Update documentation Images

Update the image links on the readme documentation instructions.

Encrypt messages sent to the destination (i.e. client to server and server to client)

Provide appropriate error messages to the user

Supports an additional client that can have its own private/public key pair

Implement using block cipher mode that combines encryption and authentication (AES-GCM)

Use the keystore for keypairs as appropriate instead of requiring user to input public key

Out of order errors are reported on the console separately from authentication and encryption errors

Print Out public key on console

Use `RSA/ECB/PKCS1Padding` for the asymmetric encryption and `SHA256withRSA` for the signing

New session key must be chosen after a number of messages N (specified on the command line)

Generate different client-server and server-client keys used with the AES-GCM cipher

Allow user to enter the public key for the destination

Create an RSA Certificate for the Server

Server sends the received key back to the client to indicate that this is the master key to be used for the session

Authenticate received messages

Update Readme instructions for Part Two

Replay attacks of session key can be detected and rejected with error shown on console and returned to client

Sign Messages that are sent to the destination

Client chooses a random AES 128-bit master key and sends it to the server

Allow the user to specify the keystore password as argument on the command line

Update Readme Instructions for Part Three

Create an RSA Certificate for the Client

sendMessage will support messages between 1 and 32 characters long

Generate the Private and Public Keys