Merge branch 't/test_man'

[paraslash.git] / web / manual.m4

diff --git a/web/manual.m4 b/web/manual.m4
index 4edce03639b5ca4b719178e148f05a98fc3a6a21..e809c8b22be7ddea6a6e9335550670098a303b06 100644 (file)
--- a/web/manual.m4
+++ b/web/manual.m4
@@ -112,7 +112,7 @@ can be used by any scripting language to produce user interfaces with
 little programming effort.
 
 All connections between para_server and para_client are encrypted
 little programming effort.
 
 All connections between para_server and para_client are encrypted

-with a symmetric RC4 session key. For each user of paraslash you must
+with a symmetric session key. For each user of paraslash you must

 create a public/secret RSA key pair for authentication.
 
 If para_client is started without non-option arguments, an interactive
 create a public/secret RSA key pair for authentication.
 
 If para_client is started without non-option arguments, an interactive


@@ -505,9 +505,9 @@ User management
 para_server uses a challenge-response mechanism to authenticate
 requests from incoming connections, similar to ssh's public key
 authentication method. Authenticated connections are encrypted using
 para_server uses a challenge-response mechanism to authenticate
 requests from incoming connections, similar to ssh's public key
 authentication method. Authenticated connections are encrypted using

-the RC4 stream cipher.
+a stream cipher, either RC4 or AES in integer counter mode.

 
 

-In this chapter we briefly describe RSA and RC4 and sketch the
+In this chapter we briefly describe RSA, RC4 and AES, and sketch the

 REFERENCE(Client-server authentication, authentication handshake)
 between para_client and para_server. User management is discussed
 in the section on REFERENCE(The user_list file, the user_list file).
 REFERENCE(Client-server authentication, authentication handshake)
 between para_client and para_server. User management is discussed
 in the section on REFERENCE(The user_list file, the user_list file).


@@ -517,8 +517,8 @@ in a REFERENCE(Connecting para_audiod, separate section).
 
 
 
 
 
 

-RSA and RC4
-~~~~~~~~~~~
+RSA, RC4, AES
+~~~~~~~~~~~~~

 
 RSA is an asymmetric block cipher which is used in many applications,
 including ssh and gpg. An RSA key consists in fact of two keys,
 
 RSA is an asymmetric block cipher which is used in many applications,
 including ssh and gpg. An RSA key consists in fact of two keys,


@@ -537,6 +537,15 @@ strong encryption by today's standards. Since the same key must never
 be used twice, a different, randomly-generated key is used for every
 new connection.
 
 be used twice, a different, randomly-generated key is used for every
 new connection.
 

+AES, the advanced encryption standard, is a well-known symmetric block
+cipher, i.e. a transformation operating on fixed-length blocks which
+is determined by a single key for both encryption and decryption. Any
+block cipher can be turned into a stream cipher by generating
+a pseudo-random key stream by encrypting successive values of a
+counter. The AES_CTR128 stream cipher used in paraslash is obtained
+in this way from the AES block cipher with a 128 bit block size.
+
+

 Client-server authentication
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Client-server authentication
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 


@@ -557,7 +566,7 @@ as follows:
        fixed-length buffer with random bytes, encrypts that buffer
        using the public key and sends the encrypted buffer to the
        client. The first part of the buffer is the challenge which
        fixed-length buffer with random bytes, encrypts that buffer
        using the public key and sends the encrypted buffer to the
        client. The first part of the buffer is the challenge which

-       is used for authentication while the second part is the RC4
+       is used for authentication while the second part is the

        session key.
 
        - para_client receives the encrypted buffer and decrypts it
        session key.
 
        - para_client receives the encrypted buffer and decrypts it


@@ -574,12 +583,12 @@ as follows:
 
        - Otherwise the user is considered authenticated and the client
        is allowed to proceed by sending a command to be executed. From
 
        - Otherwise the user is considered authenticated and the client
        is allowed to proceed by sending a command to be executed. From

-       this point on the communication is encrypted using the RC4
-       stream cipher with the session key known to both peers.
+       this point on the communication is encrypted using the stream
+       cipher with the session key known to both peers.

 
 paraslash relies on the quality of the pseudo-random bytes provided
 by the crypto library (openssl or libgcrypt), on the security of
 
 paraslash relies on the quality of the pseudo-random bytes provided
 by the crypto library (openssl or libgcrypt), on the security of

-the implementation of the RSA and RC4 crypto routines and on the
+the implementation of the RSA, RC4 and AES crypto routines and on the

 infeasibility to invert the SHA1 function.
 
 Neither para_server or para_client create RSA keys on their own. This
 infeasibility to invert the SHA1 function.
 
 Neither para_server or para_client create RSA keys on their own. This