Skip to content

Commit 74fbd2a

Browse files
TwoTenPvPTwoTenPvP
committed
Fixed public-key signature in key exchange and removed DSA support
1 parent ddc4554 commit 74fbd2a

2 files changed

Lines changed: 34 additions & 50 deletions

File tree

‎MLAPI/MonoBehaviours/Core/NetworkingManager.cs‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -683,19 +683,18 @@ private void Update()
683683
X509Certificate2 certificate = NetworkConfig.ServerX509Certificate;
684684
if (!certificate.HasPrivateKey) throw new CryptographicException("[MLAPI] No private key was found in server certificate. Unable to sign key exchange");
685685
RSACryptoServiceProvider rsa = certificate.PrivateKey as RSACryptoServiceProvider;
686-
DSACryptoServiceProvider dsa = certificate.PrivateKey as DSACryptoServiceProvider;
687686

688687
if (rsa != null)
689688
{
690-
hailWriter.WriteByteArray(rsa.SignData(diffieHellmanPublicPart, new SHA256Managed()));
691-
}
692-
else if (dsa != null)
693-
{
694-
using (SHA256Managed sha = new SHA256Managed())
689+
using (SHA256CryptoServiceProvider sha = new SHA256CryptoServiceProvider())
695690
{
696-
hailWriter.WriteByteArray(dsa.CreateSignature(sha.ComputeHash(diffieHellmanPublicPart)));
691+
hailWriter.WriteByteArray(rsa.SignData(diffieHellmanPublicPart, sha));
697692
}
698693
}
694+
else
695+
{
696+
throw new CryptographicException("[MLAPI] Only RSA certificates are supported. No valid RSA key was found");
697+
}
699698
}
700699
}
701700
// Send the hail

‎MLAPI/NetworkingManagerComponents/Core/InternalMessageHandler.Receive.cs‎

Lines changed: 28 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,6 @@
1111

1212
namespace MLAPI.Internal
1313
{
14-
//NOTE FOR TOMORROW:
15-
/*
16-
*
17-
* Change connect flow. If encryption is not enabled. Just do the current flow.
18-
* Otherwise, Do the new hail flow
19-
*
20-
* REMEMBER: MAKE SURE TO CHECK THAT YOU CANT BYPASS THE HAIL FLOW BY SENDING CONNECTION REQUEST BEFORE HAIL.
21-
* I.E ADD CHECKS
22-
*/
2314
internal static partial class InternalMessageHandler
2415
{
2516
// Runs on client
@@ -58,27 +49,17 @@ internal static void HandleHailRequest(uint clientId, Stream stream, int channel
5849
byte[] serverDiffieHellmanPublicPartSignature = reader.ReadByteArray();
5950

6051
RSACryptoServiceProvider rsa = certificate.PublicKey.Key as RSACryptoServiceProvider;
61-
DSACryptoServiceProvider dsa = certificate.PublicKey.Key as DSACryptoServiceProvider;
6252

6353
if (rsa != null)
6454
{
65-
if (!rsa.VerifyData(serverDiffieHellmanPublicPart, new SHA256Managed(), serverDiffieHellmanPublicPartSignature))
55+
using (SHA256CryptoServiceProvider sha = new SHA256CryptoServiceProvider())
6656
{
67-
if (LogHelper.CurrentLogLevel <= LogLevel.Normal) if (LogHelper.CurrentLogLevel <= LogLevel.Normal) LogHelper.LogWarning("Invalid signature. Disconnecting");
68-
netManager.StopClient();
69-
return;
70-
}
71-
}
72-
else if (dsa != null)
73-
{
74-
using (SHA256Managed sha = new SHA256Managed())
75-
{
76-
if (!dsa.VerifySignature(sha.ComputeHash(serverDiffieHellmanPublicPart), serverDiffieHellmanPublicPartSignature))
57+
if (!rsa.VerifyData(serverDiffieHellmanPublicPart, sha, serverDiffieHellmanPublicPartSignature))
7758
{
7859
if (LogHelper.CurrentLogLevel <= LogLevel.Normal) if (LogHelper.CurrentLogLevel <= LogLevel.Normal) LogHelper.LogWarning("Invalid signature. Disconnecting");
7960
netManager.StopClient();
8061
return;
81-
}
62+
}
8263
}
8364
}
8465
}
@@ -99,19 +80,18 @@ internal static void HandleHailRequest(uint clientId, Stream stream, int channel
9980
if (netManager.NetworkConfig.SignKeyExchange)
10081
{
10182
RSACryptoServiceProvider rsa = certificate.PublicKey.Key as RSACryptoServiceProvider;
102-
DSACryptoServiceProvider dsa = certificate.PublicKey.Key as DSACryptoServiceProvider;
10383

10484
if (rsa != null)
10585
{
106-
writer.WriteByteArray(rsa.SignData(certificate.GetPublicKey(), new SHA256Managed()));
107-
}
108-
else if (dsa != null)
109-
{
110-
using (SHA256Managed sha = new SHA256Managed())
86+
using (SHA256CryptoServiceProvider sha = new SHA256CryptoServiceProvider())
11187
{
112-
writer.WriteByteArray(dsa.CreateSignature(sha.ComputeHash(diffieHellmanPublicKey)));
88+
writer.WriteByteArray(rsa.Encrypt(sha.ComputeHash(certificate.GetPublicKey()), false));
11389
}
11490
}
91+
else
92+
{
93+
throw new CryptographicException("[MLAPI] Only RSA certificates are supported. No valid RSA key was found");
94+
}
11595
}
11696
}
11797
}
@@ -137,31 +117,36 @@ internal static void HandleHailResponse(uint clientId, Stream stream, int channe
137117
byte[] diffieHellmanPublicSignature = reader.ReadByteArray();
138118
X509Certificate2 certificate = netManager.NetworkConfig.ServerX509Certificate;
139119
RSACryptoServiceProvider rsa = certificate.PublicKey.Key as RSACryptoServiceProvider;
140-
DSACryptoServiceProvider dsa = certificate.PublicKey.Key as DSACryptoServiceProvider;
141120

142121
if (rsa != null)
143122
{
144-
if (!rsa.VerifyData(diffieHellmanPublic, new SHA256Managed(), diffieHellmanPublicSignature))
123+
using (SHA256CryptoServiceProvider sha = new SHA256CryptoServiceProvider())
145124
{
146-
//Man in the middle.
147-
if (LogHelper.CurrentLogLevel <= LogLevel.Normal) if (LogHelper.CurrentLogLevel <= LogLevel.Normal) LogHelper.LogWarning("Signature doesnt match for the key exchange public part. Disconnecting");
148-
netManager.DisconnectClient(clientId);
149-
return;
150-
}
151-
}
152-
else if (dsa != null)
153-
{
154-
using (SHA256Managed sha = new SHA256Managed())
155-
{
156-
if (!dsa.VerifySignature(sha.ComputeHash(diffieHellmanPublic), diffieHellmanPublicSignature))
125+
byte[] clientHash = rsa.Decrypt(diffieHellmanPublicSignature, false);
126+
byte[] serverHash = sha.ComputeHash(diffieHellmanPublic);
127+
if (clientHash.Length != serverHash.Length)
157128
{
158129
//Man in the middle.
159-
if (LogHelper.CurrentLogLevel <= LogLevel.Normal) if (LogHelper.CurrentLogLevel <= LogLevel.Normal) LogHelper.LogWarning("Signature doesnt match for the key exchange public part. Disconnecting");
130+
if (LogHelper.CurrentLogLevel <= LogLevel.Normal) if (LogHelper.CurrentLogLevel <= LogLevel.Normal) LogHelper.LogWarning("Signature length doesnt match for the key exchange public part. Disconnecting");
160131
netManager.DisconnectClient(clientId);
161132
return;
162133
}
134+
for (int i = 0; i < clientHash.Length; i++)
135+
{
136+
if (clientHash[i] != serverHash[i])
137+
{
138+
//Man in the middle.
139+
if (LogHelper.CurrentLogLevel <= LogLevel.Normal) if (LogHelper.CurrentLogLevel <= LogLevel.Normal) LogHelper.LogWarning("Signature doesnt match for the key exchange public part. Disconnecting");
140+
netManager.DisconnectClient(clientId);
141+
return;
142+
}
143+
}
163144
}
164145
}
146+
else
147+
{
148+
throw new CryptographicException("[MLAPI] Only RSA certificates are supported. No valid RSA key was found");
149+
}
165150
}
166151
}
167152
}

0 commit comments

Comments
 (0)