For a college programming assignment I have to implement a secure communication protocol between a server and one or more clients. Upon instantiation of the server program, a file is generated, call it 'server_file'. This is then placed in a known location and assumed to be made available to the client program(s) via a secure channel unavailable to a hacker.

The client program will then generate its own file, call it 'client_file', and then must be able to send commands to the server (e.g. create new account, set some value, get some value, simple transactional requests). This client_file can be thought of as a client key or PIN that allows the server to know who the user is. The point is to make it so a MitM attack or other attack will not allow an adversary to subvert the system.

I have some passing familiarity with PyCrypt and a basic understanding of major cryptographic principles. However before I get started I wanted to elicit any ideas about the best way to implement this. I was thinking of using the server_file to sign (HMAC) the client_key and send the commands from client to server (along with the transaction message) using something like AES in CTR mode.

Does this seem like a good approach? Would you do anything differently? The purpose is to secure the communication channel.

Thanks in advance!

  • 1
    Why not use a standard protocol out there IE SSH, L2TP with IPSec, TLS/SSL? Securing the connection is not the same Authentication,Authorization, and Accounting functionality. – Shane Andrie Oct 6 '15 at 22:22
  • @ShaneAndrie - I think the object of the assignment is to create a secure protocol, not use one that already exists. – Neil Smithline Oct 6 '15 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.