add the non-blind ID protocol to the txt file for reference

[xonotic/d0_blind_id.git] / d0_blind_id.txt

diff --git a/d0_blind_id.txt b/d0_blind_id.txt
index 2fa73acf50a4987ec57d21755169ed03ce6da3b9..a469118bda966b953dfbb325cda89d2a7f8e3fc2 100644 (file)
--- a/d0_blind_id.txt
+++ b/d0_blind_id.txt
@@ -61,7 +61,8 @@ Authentication protocol:
        "start":
        - Client sends S, H if this is the first round of the protocol
        - Client generates r in [0, |G|[ at random
-       - Client sends x = h("g^r || m || g^r")
+       - Client generates t in [0, |G|[ at random
+       - Client sends x = h("g^r || g^t || m || g^r || g^t")
        - Client sends m in plain
        "challenge":
        - Server receives S, H if this is the first round of the protocol
@@ -74,15 +75,14 @@ Authentication protocol:
        - Client receives c and g^T
        - Client verifies that the received values are in the allowed ranges
        - Client sends y = r + s * c mod |G|
-       - Client generates t in [0, |G|[ at random
-       - Client g^(t-r)
+       - Client sends g^t
        - Client calculates K = (g^T)^t
        "verify":
-       - Server receives y and g^(t-r)
+       - Server receives y and g^t
        - Server calculates z = g^y S^-c
        - Server calculates x' = h("z || m || z")
        - Server verifies x == x'
-       - Server calculates K = (g^(t-r) * z)^T
+       - Server calculates K = (g^t)^T
 
 Protocol variant: g and G can be also part of the public ID. In this case, g
 and G are sent as part of this protocol additionally to S, H.
@@ -113,3 +113,31 @@ Low level protocol:
          "packet"
        - a value in double quotes is also defined in terms of this protocol, i.e.
          the length is preceded
+
+
+
+NOTE: to generate NON blind IDs, the process is not very straightforward. It
+works like this:
+
+Server shall:
+- load private key
+
+Both shall:
+- perform authentication as usual
+
+Server shall:
+- notice that the status is false
+- call d0_blind_id_authenticate_with_private_id_generate_missing_signature
+- write public ID
+- send that data to client
+
+Client shall:
+- read own private ID
+- get fingerprint
+- read received public ID (leaves the private part alone)
+- verify fingerprint
+- possibly verify ID
+- write own private ID again
+
+This ensures that only the ID the client authenticated with is signed by the
+server