如何编写用于服务器身份验证的私钥/公钥系统？
我想这可能已发布在某个地方，我进行了搜索，但找不到任何内容。
我有一台运行游戏服务器的服务器，并且我想要一些 TCP 服务器（可能用 Ruby 编写），它将提供一个伪会话，其中可用的命令很少（例如重新启动游戏服务器、发送日志等） .)
我想要的是类似 SSH 的身份验证，人们可以使用 public 和 public 来进行身份验证。 DSA 私钥（我知道如何生成），服务器将公钥识别为正确的身份验证。
我不是在寻找代码实现，而是主要是如何构建它。
我的想法是这样的：
[Client]连接到服务器[Server]发送公钥[Client]发送用以下编码的公钥服务器的公钥[Server]将密钥与授权客户端的数据库进行比较[Server]生成会话密钥，使用客户端 pub 加密发送[Client] 解码会话密钥并开始发送始终伴随会话密钥的消息
但我觉得这缺少了一些东西。特别是，在查看 DSA 和 PK 系统时，我不断看到消息签名，并且我不确定我是否理解它与使用 pub 密钥进行加密和会话密钥有何不同？
如果我的问题不清楚，我当然很乐意编辑我的帖子:-)。
I guess this might have been posted somewhere, I did search, but couldn't find anything.
I have this server on which I run a game server, and where I want to have some TCP server (possibly written in Ruby) that will provide a pseudo-session with few commands available (like restart the game server, send the logs, etc.)
What I want is an SSH-like authentication, where people have public & private DSA keys (which I know how to generate), and the public key is recognized by the server as correct authentication.
I am not looking for code implementation, but mainly how this should be architectured.
What I was thinking was something like:
[Client]Connect to the server[Server]Send public key[Client]Send public key encoded with server's public key[Server]Compare the key with a database of authorized clients[Server]Generate session key, send it encrypted with client pub[Client]Decodes session key and starts sending messages always accompanied by the session key
But I feel like this is missing something. Especially, when looking at DSA and PK systems, I keep seeing message signing, and I'm not sure I understand how different it is than using pub keys to encrypt and the session key?
If my question is not clear, I'd be glad to edit my post of course :-).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
为什么不使用类似 SSH 的 SSH 呢？或者使用 SSL，它对任何平台都有几乎无处不在的库支持？
首先，它更容易。代码被编写、测试、审查和维护。
其次，更安全。如果您不明白为什么消息需要签名，您还可能忽略什么？老实说，即使是受到大量审查的 TLS（SSL），最近公布的重新协商 bug 也存在严重缺陷。即使您知道自己在做什么，设计安全协议也很困难。
顺便说一下，SSH 和 SSL 会为每个协议记录计算一个消息验证码，以便中间人无法篡改消息内容。
Instead of SSH-like, why not use SSH? Or use SSL, which has nearly ubiquitous library support for any platform?
First, it's easier. The code is written, tested, reviewed, and maintained.
Second, it's safer. If you don't understand why messages need to be signed, what else might you be overlooking? Honestly, even TLS (SSL), which has had a lot of scrutiny, had a serious flaw in the renegotiation bug that was recently publicized. Even when you know what you are doing, designing a secure protocol is hard.
By the way, SSH and SSL compute a message authentication code for every protocol record so that a man-in-the-middle cannot tamper with the message content.
如果您想要类似 SSL 的实现，那么为什么不直接使用 SSL 呢？
If you want a SSL like implementation, then why not just use SSL?
如果您确实选择实施自己的安全层（这有时是正确的答案），则需要注意许多微妙之处。首先阅读我认为该主题的权威坟墓：
Bruce Schneier 的应用密码学
If you do choose to go the route of implementing your own layer of security (which is sometimes the right answer), there are a lot of subtleties to be aware of. Start by reading what I consider the definitive tomb on the topic:
Bruce Schneier's Applied Cryptography