seconn

README

Se(cure) Conn(ection)

seconn is a simple golang library that provides an encrypted connection over a net.Conn.

It uses curve25519 to establish a shared key between the 2 parties and then uses AES encryption to pass the data back and forth.

How do a do any kind of authentication to prevent a MITM attack?

Check out the auth package. It uses the GetMessage/SendMessage API to perform a signed token exchange and verifies that the server side is using the agreed upon key.

Documentation

Index

• Variables
• func GenerateKey(rand io.Reader) (publicKey, privateKey *[32]byte, err error)
• type Conn
  • func NewClient(u net.Conn) (*Conn, error)
  • func NewConn(c net.Conn) (*Conn, error)
  • func NewServer(u net.Conn) (*Conn, error)
  • func (c *Conn) AuthToken() []byte
  • func (c *Conn) GetMessage() ([]byte, error)
  • func (c *Conn) Negotiate(server bool) error
  • func (c *Conn) PeerAuthToken() []byte
  • func (c *Conn) Read(buf []byte) (int, error)
  • func (c *Conn) RekeyNext()
  • func (c *Conn) SendMessage(msg []byte) error
  • func (c *Conn) Write(buf []byte) (int, error)

Variables

var ErrBadHeader = errors.New("bad header")

var ErrBadRekey = errors.New("error in rekey processing")

var ErrProtocolError = errors.New("protocol error")

var KeyValidityPeriod = 1 * time.Hour

var RekeyAfterBytes = 100 * 1024 * 1024

How many bytes to write over the connection before we rekey This is bidirectional, so it will trip whenever either side has sent this ammount.

var WriteBufferSize = 128

The size of the internal encrypted write buffer

Functions

func GenerateKey

func GenerateKey(rand io.Reader) (publicKey, privateKey *[32]byte, err error)

Generate new public and private keys. Automatically called by Negotiate

Types

type Conn

type Conn struct {
	net.Conn
	// contains filtered or unexported fields
}

func NewClient

func NewClient(u net.Conn) (*Conn, error)

Create a new connection and negotiate as the client

func NewConn

func NewConn(c net.Conn) (*Conn, error)

Create a new connection. Negotiate must be called before the connection can be used.

func NewServer

func NewServer(u net.Conn) (*Conn, error)

Create a new connection and negotiate as the server

func (*Conn) AuthToken

func (c *Conn) AuthToken() []byte

func (*Conn) GetMessage

func (c *Conn) GetMessage() ([]byte, error)

Read a message as a []byte

func (*Conn) Negotiate

func (c *Conn) Negotiate(server bool) error

Exchange keys and setup the encryption

func (*Conn) PeerAuthToken

func (c *Conn) PeerAuthToken() []byte

func (*Conn) Read

func (c *Conn) Read(buf []byte) (int, error)

Read data into buf, automatically decrypting it

func (*Conn) RekeyNext

func (c *Conn) RekeyNext()

On the next Write(), rekey the stream

func (*Conn) SendMessage

func (c *Conn) SendMessage(msg []byte) error

Write msg to the other side

func (*Conn) Write

func (c *Conn) Write(buf []byte) (int, error)

Write data, automatically encrypting it