Add a bit of hardening in the network certificate of membership by incorporating a full hash of the identity to which it is issued. This means the recipient need not depend entirely on the root verifying identities properly to make sure impersonation is not occurring.

This commit is contained in:
Adam Ierymenko 2021-09-20 18:26:49 -04:00 committed by Grant Limberg
parent 9cfb807fcb
commit 134d33c218
No known key found for this signature in database
GPG key ID: 2BA62CCABBB4095A
7 changed files with 78 additions and 42 deletions

View file

@ -561,8 +561,8 @@ static int testCertificate()
std::cout << idA.address().toString(buf) << ", " << idB.address().toString(buf) << std::endl;
std::cout << "[certificate] Generating certificates A and B...";
CertificateOfMembership cA(10000,100,1,idA.address());
CertificateOfMembership cB(10099,100,1,idB.address());
CertificateOfMembership cA(10000,100,1,idA);
CertificateOfMembership cB(10099,100,1,idB);
std::cout << std::endl;
std::cout << "[certificate] Signing certificates A and B with authority...";
@ -574,13 +574,13 @@ static int testCertificate()
//std::cout << "[certificate] B: " << cB.toString() << std::endl;
std::cout << "[certificate] A agrees with B and B with A... ";
if (cA.agreesWith(cB))
if (cA.agreesWith(cB, idB))
std::cout << "yes, ";
else {
std::cout << "FAIL" << std::endl;
return -1;
}
if (cB.agreesWith(cA))
if (cB.agreesWith(cA, idA))
std::cout << "yes." << std::endl;
else {
std::cout << "FAIL" << std::endl;
@ -588,18 +588,18 @@ static int testCertificate()
}
std::cout << "[certificate] Generating two certificates that should not agree...";
cA = CertificateOfMembership(10000,100,1,idA.address());
cB = CertificateOfMembership(10101,100,1,idB.address());
cA = CertificateOfMembership(10000,100,1,idA);
cB = CertificateOfMembership(10101,100,1,idB);
std::cout << std::endl;
std::cout << "[certificate] A agrees with B and B with A... ";
if (!cA.agreesWith(cB))
if (!cA.agreesWith(cB, idB))
std::cout << "no, ";
else {
std::cout << "FAIL" << std::endl;
return -1;
}
if (!cB.agreesWith(cA))
if (!cB.agreesWith(cA, idA))
std::cout << "no." << std::endl;
else {
std::cout << "FAIL" << std::endl;