0

I have a system composed by different computers that must communicate in a real-time context.

All the communications must be encrypted and this system is not connected to Internet, it's just a bunch of computers that are connected via different switches.

Each computer can have different connections to the other ones, acting both as server and/or client, using both UDP and / or TCP.

What I'd like to do is to implement something not bulky or too complex. My idea was to use in some way AES 128 (or 256) and GCM mode.

I was thinking that the there might be a central server in charge of distributing a single key that can be used by all the other computers to encrypt all the data. Specifically, I was thinking to upload all the public keys to this computer and then each client, at system startup, retrieves the key from the server, and uses this key to encrypt the communication with AES. Basically I'm saying to use AES with a pre-shared key that can be obtained from a central server.

The password created in the central server could be changed manually or automatically generated every day.

What do you think about this design? I'm planning to develop everything in C++, any suggestion about which technology / library should I use?

I've seen there's the low level libcrypto++ but that there is also OpenSSL that provides both TLS and DTLS capabilities. Is it possible to set OpenSSL to create a system like the one I've described or should I use other libraries like libcrypto++?

  • 2
    Use ssl, use a CA, don't try to reinvent it yourself. – Stephane Jul 6 '18 at 12:26
  • It sounds like you're trying to reimplement SSL/TLS manually... all of this stuff is done behind the scenes, by negotiating keys in a secure manner. Why are you trying to do it this way? You're painting yourself into a corner w/o any apparent reason IMO. – Kritner Jul 8 '18 at 11:52
  • well, I just need something easy to add to my application that has the least impact to the performances. If SSL /TLS allows me to do what I want I'd use it for sure! does it allow to do what I wrote in my question, specifically to get (via asymmetric encryption) just once the password that will be used to encrypt / decrypt everything ? – svoltron Jul 9 '18 at 7:03
  • are you sure it's possible to do everything I want to? for instance, is it possible to negotiate a single key to use for ten different communications ? – svoltron Jul 9 '18 at 9:50
1

This is a comment, but space is limited.

Based on the information provided, the best advice is: do not attempt this.

to use in some way AES 128 (or 256) and GCM mode

Go look at some security vulnerabilities involving encryption. The algorithm is important, but most of the problems arise in the "some way" part.

All the communications must be encrypted

Then either you need to modify all the client code and all the server code or rewrite the networking stack in the OS.

Why do they need to be encrypted? Is it just for confidentiality as the data crosses the network Do you want to implement bi-directional authentication?

this system is not connected to Internet...for a system that must stay online on Internet

Eh?

Do the hosts connect to/provide things other than the services you are trying to protect?

It sounds like you just need a VPN.

any suggestion about which technology / library should I use?

You really don't understand what you are trying to achieve, so its understandable that you're not able to ask the right questions. There are lots of technologies available which are well written, maintained and supportable (but there's not even enough information here to point you in the right direction).

  • Thank you for your reply, really appreciated. For sure I am not an expert, I am trying to read as much as I can though. I've edited the question, the "internet" sentence was not really clear indeed. What I meant was that I don't need something bulky like certificates or complex things but just a simple way to encrypt the communication between different applications. There are some communications that in effect should not be encrypted so VPN might not be the ideal solution – svoltron Jul 6 '18 at 12:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.