root/doc/security.txt

Keys:

    Users:
        1 bank account key: certificate is signed by bank
        h host account key: certificate is signed by host

    Bank:
        bank key: certificate signed by CA

    Hosts:
        host key: certificate signed by owner

    SLS:
        No key

Operations:
    Bank:
        all use bank account key

    Host:
        create_account uses bank account key
        others use host account key
        login uses reformed ssl key

    SLS:
        clients are not authenticated
        data put in SLS is signed by host

SLS:
        register()
                data is signed with host key
                can only register source address

        unregister()
                authenticate with host key

Bank:
        all operations use bank account key

Host:
        create_account()
                

Typical sequence:

1) host - register -> SLS

2) host - unregister -> SLS

3) client - query -> SLS

4) SLS - query reply -> client

5) client - transfer -> bank

6) bank - transfer reply -> client

7) client - create account -> host

8) host - create account reply -> client

8) 

Attacks:
1) MIM on 1), substitute self as owner, different host key
   difficult for attacker to claim IP address
   mitigated if user caches host keys
   user should consider (owner, IP) tuple for reputation

2) 1) with own machine, but substitute other user as owner

3) Spoof 2), Dos
   difficult for attacker to claim IP address
   prevented because 2) requires host authentication

3) MIM on 3), substitute false information
   

------------------------------------------------------------------------------

Simplified xml-rpc security:

Attacks:
1) modification
2) spoofing
3) replay

Note, we do not require encryption.

Assumptions:
C knows K_c, {K_c}^-1, K_s, and N_c
S knows K_s, {K_s}^-1, K_c, and P_c < N_c

1) C->S: C, S, N_c, M, MAC_{{K_c}^-1}(C, S, M, N_c)
2) C<-S: C, S, N_c, R, MAC_{{K_s}^-1}(C, S, R, N_c)

Notes:
a) when C sends 1), it increments N_c

b) when S receives 1), it checks that N_c > P_c. If so, it sets P_c =
N_c, otherwise, it drops the message.

c) when C receives 2), it checks that N_c == old N_c