5 govpn is simple high-performance secure virtual private network daemon.
6 It uses DH-EKE for mutual zero-knowledge authentication and
7 authenticated encrypted transport.
11 All packets captured on network interface are encrypted, authenticated
12 and sent to remote server, that writes them to his interface, and vice
13 versa. Client and server use pre-shared authentication key (PSK).
14 Because of stateless UDP nature, after some timeout of inactivity peers
15 forget about each other and have to retry handshake process again. As a
16 rule, there are enough time-to-time traffic in ordinary Ethernet
17 networks to heartbeat connection.
19 Handshake is used to mutually authenticate peers, exchange common secret
20 per-session encryption key and checks UDP transport availability.
22 Because of UDP and authentication overhead: each packet grows in size
23 during transmission, so you have to lower you maximum transmission unit
24 (MTU) on network interface.
26 High security and high performance are the goals for that daemon. It
27 uses fast cryptography algorithms with 128bit security margin, strong
28 mutual zero-knowledge authentication and perfect-forward secrecy
29 property. An attacker can not know anything from captured traffic, even
30 if pre-shared key is compromised.
35 * Perfect-forward secrecy (if long-term pre-shared keys are compromised,
36 no captured traffic can be decrypted anyway)
37 * Mutual two-side authentication (noone will send real network interface
38 data unless the other side is authenticated)
39 * Zero-knowledge authentication (pre-shared key is not transmitted in
40 any form between the peers, not even it's hash value)
45 B -- bad UDP packet (some system error)
46 T -- bad tag on packet (MiTM, unordered packet)
47 R -- invalid sequence number (MiTM, unordered packet)
48 [HS?] -- unknown handshake message
49 w -- successful write to remote peer
50 r -- successful read from remote peer
51 [HS1], [HS2], [HS3], [HS4] -- handshake packet stage
52 [rS?] -- invalid server's random authentication number received (MiTM, bad PSK)
53 [rC?] -- invalid client's random authentication number received (MiTM, bad PSK)
54 [S?] -- invalid handshake stage is trying to perform (MiTM, duplicate packet)
55 [OK] -- handshake's stage passed
59 Let's assume that there is some insecure link between your computer and
60 WiFi-reachable gateway. You have got preconfigured wlan0 network
61 interface with 192.168.0/24 network. You want to create virtual
62 encrypted and authenticated 172.16.0/24 network and use it as a default
63 transport. MTU for that wlan0 is 1500 bytes. GoVPN will say that maximum
64 MTU for the link is 1476, however it does not take in account TAP's
65 Ethernet frame header length, that in my case is 14 bytes long (1476 - 14).
67 gateway% ip addr add 192.168.0.1/24 dev wlan0
68 gateway% tunctl -t tap10
69 gateway% ip link set mtu 1462 dev tap10
70 gateway% ip addr add 172.16.0.1/24 dev tap10
71 gateway% ip link set up dev tap10
72 gateway% govpn -key KEY -iface tap10 -bind 192.168.0.1:1194
74 pc% ip addr add 192.168.0.2/24 dev wlan0
76 pc% ip link set mtu 1462 dev tap10
77 pc% ip addr add 172.16.0.2/24 dev tap10
78 pc% ip link set up dev tap10
79 pc% ip route add default via 172.16.0.1
80 pc% govpn -key KEY -iface tap10 -remote 192.168.0.1:1194
85 Message authentication: Poly1305
86 Password authenticated key agreement: Curve25519 based DH-EKE
87 Packet overhead: 24 bytes per packet
88 Handshake overhead: 4 UDP (2 from client, 2 from server) packets,
89 232 bytes total payload
93 SERIAL + ENC(KEY, SERIAL, DATA) + AUTH(SERIAL + ENC_DATA)
95 where SERIAL is message serial number. Odds are reserved for
96 client->server, evens are for server->client. SERIAL is used as a nonce
97 for DATA encryption: encryption key is different during each handshake,
98 so (key, nonce) pair is always used once.
100 We generate Salsa20's output using this key and nonce for each message:
101 * first 256 bits are used as a one-time key for Poly1305 authentication
102 * next 256 bits of output are ignored
103 * and all remaining ones XORed with the data, encrypting it
110 │ │ R=rand(64bit); CPrivKey=rand(256bit)
113 │ R, enc(PSK, R, CPubKey) │
114 │ ────────────────────────────────────────>
117 │ │ │ SPrivKey=rand(256bit)
121 │ │ │ K=DH(SPrivKey, CPubKey)
125 │ │ │ RS=rand(64bit); SS=rand(256bit)
128 │ enc(PSK, R+1, SPubKey); enc(K, R, RS+SS)│
129 │ <────────────────────────────────────────
132 │ │ K=DH(CPrivKey, SPubKey) │
136 │ │ RC=rand(64bit); SC=rand(256bit) │
139 │ enc(K, R+1, RS+RC+SC) │
140 │ ────────────────────────────────────────>
147 │ │ │ MasterKey=SS XOR SC
151 │ <────────────────────────────────────────
158 │ │ MasterKey=SS XOR SC │
164 * client generates CPubKey, random 64bit R that is used as a nonce
166 * R + enc(PSK, R, CPubKey) + NULLs -> Server [56 bytes]
167 * server remembers clients address, decrypt CPubKey, generates
168 SPrivKey/SPubKey, computes common shared key K (based on
169 CPubKey and SPrivKey), generates 64bit random number RS and
170 256bit random SS. PSK-encryption uses incremented R (from previous
172 * enc(PSK, SPubKey) + enc(K, RS + SS) + NULLs -> Client [88 bytes]
173 * client decrypt SPubKey, computes K, decrypts RS, SS with key K,
174 remembers SS, generates 64bit random number RC and 256bit random SC,
175 * enc(K, RS + RC + SC) + NULLs -> Server [64 bytes]
176 * server decrypt RS, RC, SC with key K, compares RS with it's own one
177 send before, computes final main encryption key S = SS XOR SC
178 * ENC(K, RC) + NULLs -> Client [24 bytes]
179 * server switches to the new client
180 * client decrypts RC and compares with it's own generated one, computes
181 final main encryption key S
183 Where PSK is 256bit pre-shared key, NULLs are 16 null-bytes. R* are
184 required for handshake randomization and two-way authentication. K key
185 is used only during handshake. NULLs are required to differentiate
186 common transport protocol messages from handshake ones. DH public keys
187 can be trivially derived from private ones.
192 * http://cr.yp.to/ecdh.html
193 * http://cr.yp.to/snuffle.html
194 * http://cr.yp.to/mac.html
195 * http://grouper.ieee.org/groups/1363/passwdPK/contributions/jablon.pdf
196 * Applied Cryptography (C) 1996 Bruce Schneier
200 * Move decryption and encryption processes into goroutines
201 * Add identity management (client can send it's identification, server has
202 on-disk id↔key plaintext database)
203 * Implement alternative Secure Remote Password protocol (it is much slower,
204 technically has more code, but human memorized passwords can be used
209 This program is free software: you can redistribute it and/or modify
210 it under the terms of the GNU General Public License as published by
211 the Free Software Foundation, either version 3 of the License, or
214 This program is distributed in the hope that it will be useful,
215 but WITHOUT ANY WARRANTY; without even the implied warranty of
216 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
217 GNU General Public License for more details.