xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

authsrv(6): document session secret key derivation for p9sk1 and dp9ik

Browse source
This commit is contained in:
cinap_lenrek 2016-08-08 02:03:06 +02:00
parent c6318ecb17
commit 62ad8fc8df
1 changed files with 11 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

18
sys/man/6/authsrv
View file

@ -284,6 +284,10 @@ proving to the client that it also knows
.I Kn .I Kn
and therefore and therefore
.I Ks . .I Ks .
.PP
The 64-bit shared secret
.I Kn
is used as the session secret.
.SS "Password authenticated key exchange" .SS "Password authenticated key exchange"
Initially, the server and client keys Initially, the server and client keys
.I Ks .I Ks
@ -527,7 +531,7 @@ and contributes its random string
.IR RNs .IR RNs
for the session secret. for the session secret.
.PP .PP
The 2048-bit session secret is derived with a PRF hashing the The 2048-bit session secret is derived with HKDF-SHA256 hashing the
concatenated random strings concatenated random strings
.IR RNc | RNs .IR RNc | RNs
with the the shared secret key with the the shared secret key
@ -586,16 +590,16 @@ authentication files
and and
.IR attach (5)). .IR attach (5)).
Other services, such as Other services, such as
.IR cpu (1) .IR cpu (1),
.IR exportfs (4)
and and
.IR exportfs (4), .IR tlssrv (8)
run run
.I p9any .I p9any
over the network and then over the network and then use the session secret to derive an
use
.I Kn
to derive an
.IR ssl (3) .IR ssl (3)
or
.IR tls (3)
key to encrypt the rest of their communications. key to encrypt the rest of their communications.
.SS "Password Change .SS "Password Change
Users connect directly to the AS Users connect directly to the AS