top

Manage Velociraptor's CA and key signing.

This encryption scheme was originally used in the GRR communication
protocol.

It is designed for the following goals:

1. The protocol can be bootstrapped with zero knowledge - there is no

need to store previous session keys (symmetric keys). If the
session key for each packet is not known then it can always be
possible to recalculate it.

2. Once the session key is derived, then it may be cached. Caching the

session key saves the end point from performing expensive RSA
operations. This is purely an optimization.

3. The cipher object contains the session key as well as the hmac

key. The cipher proto is encrypted using the receiver public key so
only the receiver may decrypt it.

4. To verify the authenticity of the cipher object, one must decrypt

it, extract the session key and use that to decrypt the
encrypted_cipher_metadata field. That field contains the RSA for
the cipher object (signed using the sender's private key). Note
that since the cipher does not change throughout the session,
neither does the encrypted_cipher_metadata and so both can be
cached (and signature verification is not needed if the cipher blob
was seen previously.

5. Integrity of each packet's payload is assured through a HMAC. The

hmac key is consta nt throughout the session and it is specified in
the cipher object. Note we check the hmac before anything else to
reject malformed packets earlier and save some cycles.

Imports 10 package(s)

  1. github.com/pkg/errors
  2. www.velocidex.com/golang/velociraptor/third_party/cache
  3. www.velocidex.com/golang/velociraptor/logging
  4. www.velocidex.com/golang/velociraptor/crypto/proto
  5. www.velocidex.com/golang/velociraptor/api/proto
  6. www.velocidex.com/golang/velociraptor/datastore
  7. github.com/rcrowley/go-metrics
  8. www.velocidex.com/golang/velociraptor/urns
  9. github.com/golang/protobuf/proto
  10. www.velocidex.com/golang/velociraptor/config

Test imports 2 package(s)

  1. github.com/stretchr/testify/assert
  2. github.com/stretchr/testify/suite