> Given 16 networks A,B,C,..,P all internet connected. Within each
>network is a reasonably secure subnet designated by small letters
>a,b,c,...,p. I wish these subnets to have safe encrypted telnet
>and ftp sessions with each other. Encryption keys should be
>associated with the originating user within the subnet, rather than
>the originating machine within the subnet.
Probably the easiest way is to take the net2 sources
for telnetd, which have hooks in them for encryption, and modify
them to use some other scheme for key exchange. FTP presently
doesn't have any encrypting versions I know of.
Key exchange is always the biggest hassle in doing this
kind of thing. The simplest route (using a random key and a
diffie hellman exchange) is patented and therefore not an option
unless you want to work through licensing issues. One neat approach
would be to use something like a SecurID or Digital Pathways to
implement your key exchange. You could use that authentication
to unlock a shared secret on each side of the connection and then
start using crypto. I.e.: suppose each machine has a database
with a secret key for 'mjr'. I use a Digital pathways for
authenticating, which means I am exchanging a random challenge
and response as part of the authentication. Once I've authenticated
both sides unlock the secret key, Xor it with the random challenge
response, and use that as a session key. I suspect that would
be pretty much good enough. The BSD folks use kerberos to do
their key exchange (in a sense, that's what getting a kerberos
ticket is) - you could use those versions directly if you use
kerberos. That still leaves FTP.
The other option is to use a point to point encrypting
router for encrypting all traffic between the two networks,
which is not quite what you asked for, since that doesn't have
any notion of a per-user key or even a "user" in it.
mjr.
|
|
