For a college programming assignment I have to implement a secure communication protocol between a server and one or more clients. Upon instantiation of the server program, a file is generated, call it 'server_file'. This is then placed in a known location and assumed to be made available to the client program(s) via a secure channel unavailable to a hacker.

The client program will then generate its own file, call it 'client_file', and then must be able to send commands to the server (e.g. create new account, set some value, get some value, simple transactional requests). This client_file can be thought of as a client key or PIN that allows the server to know who the user is. The point is to make it so a MitM attack or other attack will not allow an adversary to subvert the system.

I have some passing familiarity with PyCrypt and a basic understanding of major cryptographic principles. However before I get started I wanted to elicit any ideas about the best way to implement this. I was thinking of using the server_file to sign (HMAC) the client_key and send the commands from client to server (along with the transaction message) using something like AES in CTR mode.

Does this seem like a good approach? Would you do anything differently? The purpose is to secure the communication channel.

Thanks in advance!

  • 1
    $\begingroup$ Does the assignment require you to invent/implement your own protocol or just implement communication using whatever? You should use e.g. TLS if permitted. $\endgroup$ – otus Oct 7 '15 at 6:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.