Demo

---

Overview

1. The client sends a request to the KDC, stating that it wants to be authenticated.
2. The KDC responds with a challenge by sending the client a nonce and expects to receive back an encrypted nonce using the client's secret_key.
3. The client receives the challenge, encrypts the nonce as instructed, and sends the encrypted nonce back to the KDC.
4. The KDC decrypts the nonce and compares it to the one it originally sent to the client. If they match, it proves that the client possesses the correct secret_key (proof of access to the shared secret, i.e., secret_key).
5. The KDC generates a shared key for the PrnSrv and the client.
6. The KDC creates a ticket (an encrypted message containing client information and the shared key), which is encrypted using PrnSrv's secret_key (established for secure communication between the KDC and PrnSrv).
7. The KDC sends the ticket along with the shared key to the client, completing the authentication process.
8. The client uses the shared key for further communication with PrnSrv.
9. The client sends the ticket to PrnSrv.
10. PrnSrv receives the ticket, decrypts it using its secret_key, and verifies the client's authentication (i.e., it checks whether the client's information matches the details contained in the ticket).
11. Upon successful authentication, PrnSrv accepts the client's text for conversion to PDF.
12. PrnSrv converts the text to a PDF using enscript and ps2pdf.
13. PrnSrv sends the PDF size along with the PDF data itself to the client.
14. The client saves the PDF data to a file.

P.S.

All communication mentioned above is encrypted using:

• The client-KDC shared secret,
• The KDC-PrnSrv shared secret,
• The client-PrnSrv shared secret generated by the KDC upon authentication.

These secrets ensure secure communication between the client and KDC, KDC and PrnSrv, and client and PrnSrv, respectively.

This protocol is heavily inspired by Kerberos.

Getting Started

mkdir build
cd build
cmake ..
make

Launch three shell instances: run ./kdc in the first, ./prnsrv in the second, and ./client in the third for testing.

References

• socket-server-client-c - nos1dot618
• steel/hashmap.h - nos1dot618