CMPSC 447: Software Security, Spring 2019

Encrypted File Transfer

In this project, you will develop a client-server system that provides encrypted file transfer. You will use the OpenSSL library to implement encryption and pseudo-random number generation.

The system you produce must run on the Westgate Linux lab machines. These machines are named cse-p204instXX.cse.psu.edu, where XX is a number between 01 and about 40. All these machines should be identical and already have the OpenSSL library installed.

Overview

The encrypted file transfer system will work as follows. By invoking "server genkey", the server program should generate a key file saved in a local file. By invoking "server recvfile", the server program starts and waits for connections from clients.

The client program will be started by the following command line: client file-to-transfer server-ip-address 1 1: where (1) file-to-transfer is the pathname of the file to transfer from the client to the server and (2) server-ip-address is the IP address of the server host; you can use the ifconfig program in Linux to find out the IP address of the server. The last two arguments are fixed; we will not use them in this project.

Start the server first, as it will wait for connection requests from clients. When a connection request is received from a client, the file-to-transfer will be sent encrypted and integrity protected from the client to the server. The server will store the file in a directory called "shared" under the directory from which the server is run. The client will terminate and the server will await the next request from the next client.

Project Tasks

Perform the project tasks listed below in the following order.

Download project tarball

The project tarball includes source code and a Makefile for building the tarball for your project for submission.

Part 0: Understand the file structure in the project tarball, what code is already there, and what code you need to write. Here is a brief description of the source-code files included:

siis-network.c: provides convenience wrappers on top of socket-based networking communication API.
siis-ssl.c: provides convenience wrappers for crypto operations on top of the OpenSSL API.
siis-util.c: utility code for reading files, etc.
main.c: code for starting the server and the client; the client sends the request and the server responds.
transfer.c: the implementation of encrypted file transfer. All your code should be implemented in this file; search for "fill in your code here".
Makefile: you can use this for compiling the program code and producing tarballs for project submission.

Part 1 (5 points): Write the function to generate pseudorandom values

Develop the function generate_pseudorandom_bytes by using the OpenSSL API for producing pseudorandom values. This online documentation is helpful in understanding how to use OpenSSL for pseudorandom number generation; you should use the software-based method for random number generation.

Part 2 (5 points): Write save_key and load_key

Write the function for saving an encryption key (generated from generate_pseudorandom_bytes; see main.c) into a local file; also write the function for loading an encryption key from a local file.

After this step, "server genkey" should be complete and be able to generate a key file "enckey" in the local directory.

Part 3 (5 points): Write encrypt_message and decrypt_message

Write the functions to build encrypted messages for sending and decrypted received messages. The encryption function must perform AES encryption and produce a buffer containing the data necessary for the other party to decrypt. The decryption function must extract the necessary information from a sent buffer and perform the decryption.

The initial version of the program includes a function test_aes that encrypts a message. It demonstrates how to perform symmetric encryption with the OpenSSL library, which should be a big help. You will note that a 16-byte initialization vector is needed for encryption. In addition to the ciphertext, AES encryption produces also a 16-byte tag, which is used for integrity checking.

Part 4 (5 points): Transfer the file securely

Implement the encryption and transfer functionality to send the file from the client to the server in the function transfer_file.

Only one file will be transferred per use (i.e., no need to support wildcards, directory copies, etc.). You need to extend the function transfer_file to collect the next file block, perform encryption of the file data in the block, generate the message to send, and send the encrypted file block message to the server. The function receive_file (for the server) is provided, which may help a bit. See also the ProtoMessageType enumeration type in transfer.h for more information.

Currently the server listens to port 9165 for connections. If somehow your program fails to create the server socket, one possibility is that another student's program has already used that port on the machine where the server is running. You can change the port number in siis_network.h to resolve this issue.

What you need to submit

Submit your work through Canvas. Part 1 and 2 are due on Feb 15th; Part 3 and 4 are due on Feb 22nd. The submission should be a tarball created by using "make tar".

In total, you should need to write only about 100 lines of code. You should rethink if your approach requires significantly more code than that.