• I’ve recently participated in a project of management among nodes in a cluster, it’s developed in golang.
  • My part is to develop a package to ensure those messages of communication between schedulers and executors are well encrypted, only receivers can decrypt them.

  • All codes in this article are permitted by other members in the project team to share.

  • Idea: This module both utilize rsa public key/private key and symmetric key.

    • symmetric key: generate a random symmetric key, and use the same key to encrypt and decrypt. In this module, we use package chacha20poly1305(https://godoc.org/golang.org/x/crypto/chacha20poly1305) and “crypto/rand” to finish this step. The symmetric key here is to encrypt/decrypt those message that nodes attempt to send or receive.
    • rsa keypairs: generate a pair of rsa keys as public key and private key to encrypt and decrypt. In this module, we first generate a random rsa keypair strings in keys.go, and use functions in crypting.go to handle those strings. The rsa keypairs here are to encrypt/decrypt the same symmetric key above to keep that key from being cracked by unknown hackers.
      • The sender and receiver are corresponding to “scheduler” or “executor” in the project, so that there are 2 pairs of rsa keys for both characters.

1. generate key pairs

  • prepare 2 pairs (as scheduler or executor) of private/public keys as generateKeyPairs.go: ```go package main

import ( “fmt”

  1. "ire.com/clustershell/crypting"

)

const ( // variable length of generated asymmetric keys(128, 256, 512, 2048…) asymmetricKeySize = 1024 )

func main() { fmt.Println(“package keypairs\n”)

  1. pvtkeyScheduler, pubkeyScheduler := crypting.GenerateKeyPair(asymmetricKeySize)
  2. pvtkeyExecutor, pubkeyExecutor := crypting.GenerateKeyPair(asymmetricKeySize)
  4. pvtbyteScheduler := crypting.PrivateKeyToBytes(pvtkeyScheduler)
  5. pubbyteScheduler := crypting.PublicKeyToBytes(pubkeyScheduler)
  7. pvtbyteExecutor := crypting.PrivateKeyToBytes(pvtkeyExecutor)
  8. pubbyteExecutor := crypting.PublicKeyToBytes(pubkeyExecutor)
  10. fmt.Printf("var PvtkeyScheduler = `%s`\n", string(pvtbyteScheduler))
  11. fmt.Printf("var PubkeyScheduler = `%s`\n", string(pubbyteScheduler))
  13. fmt.Printf("var PvtkeyExecutor = `%s`\n", string(pvtbyteExecutor))
  14. fmt.Printf("var PubkeyExecutor = `%s`\n", string(pubbyteExecutor))

}

  2. - In Makefile, add these lines to redirect generateKeyPairs.go and save key pairs in keys.go:
  3. ```go
  4. all:
  5.     @$(MAKE) --no-print-directory generatekeypairs
  6. //...
  7. .PHONY: generatekeypairs
  8. generatekeypairs:
  9.     go run ./cmd/keygen/generateKeyPairs.go > ./crypting/keypairs/keys.go
  • 2 pairs of keys are all strings

2. crypting.go update

  • Because 2 pairs of keys in keys.go are strings instead of rsa.PrivateKey or rsa.PublicKey, here are two new functions to handle encrypting/decrypting in crypting.go: ```go // Encrypt with public key string instead of rsa.PublicKey func Encrypt(unencrypted []byte, pubkeystr string) ([]byte, error) { pubkey := BytesToPublicKey([]byte(pubkeystr))

    hash := sha1.New() ciphertext, err := rsa.EncryptOAEP(hash, rand.Reader, pubkey, unencrypted, nil) if err != nil {

    1.   logger.Error(err)

    }

    return ciphertext, err }

// Decrypt with private key string instead of rsa.PrivateKey func Decrypt(encrypted []byte, pvtkeystr string) ([]byte, error) { pvtkey := BytesToPrivateKey([]byte(pvtkeystr))

  1. hash := sha1.New()
  2. plaintext, err := rsa.DecryptOAEP(hash, rand.Reader, pvtkey, encrypted, nil)
  3. if err != nil {
  4.     logger.Error(err)
  5. }
  7. return plaintext, err

}

  2. ---
  4. <a name="to6ip"></a>
  5. ### Test file (only use rsa keypairs):
  6. ```go
  7. package main
  9. import (
  10.     "fmt"
  12.     "ire.com/clustershell/crypting"
  13.     "ire.com/clustershell/crypting/keypairs"
  14. )
  16. func main() {
  17.     fmt.Println("\n", "kengen_crypt", "\n")
  19.     pvtkeystrScheduler := keypairs.PvtkeyScheduler
  20.     pubkeystrScheduler := keypairs.PubkeyScheduler
  22.     fmt.Printf("Scheduler_private_key_byte_str\n%v", pvtkeystrScheduler)
  23.     fmt.Printf("Scheduler_public_key_byte_str\n%v", pubkeystrScheduler)
  25.     pvtkeystrExecutor := keypairs.PvtkeyExecutor
  26.     pubkeystrExecutor := keypairs.PubkeyExecutor
  28.     fmt.Printf("Executor_private_key_byte_str\n%v", pvtkeystrScheduler)
  29.     fmt.Printf("Executor_public_key_byte_str\n%v", pubkeystrScheduler)
  32.     msgScheduler := []byte("Hello World scheduler")Str
  33.     encryptedScheduler, _ := crypting.EncryptWithPublicKeyStr(msgScheduler, pubkeystrScheduler)
  34.     fmt.Println(string(encryptedScheduler))
  36.     unencryptedScheduler, _ := crypting.DecryptWithPrivateKeyStr(encryptedScheduler, pvtkeystrScheduler)
  37.     fmt.Println(string(unencryptedScheduler))
  40.     msgExecutor := []byte("Hello World executor")
  41.     encryptedExecutor, _ := crypting.EncryptWithPublicKeyStr(msgExecutor, pubkeystrExecutor)
  42.     fmt.Println(string(encryptedExecutor))
  44.     unencryptedExecutor, _ := crypting.DecryptWithPrivateKeyStr(encryptedExecutor, pvtkeystrExecutor)
  45.     fmt.Println(string(unencryptedExecutor))
  46. }

3. Extension of symmetric key

  • Due to the situation that only pass with rsa keypairs cannot pass long messages (for example, keypairs with length of 4096 bytes can pass messages of 470 bytes), we use packs of symmetric keys instead.
  • In specific, we apply golang package chacha20poly1305

  • First, we have to update crypting.go for new packs and constants ```go import ( “crypto/rand” “crypto/rsa” “crypto/sha1” “crypto/x509” “encoding/pem”

    “ire.com/clustershell/logger”

    cryptorand “crypto/rand”

    chacha “golang.org/x/crypto/chacha20poly1305” )

const ( // KeySize is the size of the key used by this AEAD, in bytes. KeySize = 32

  1. // NonceSize is the size of the nonce used with the standard variant of this
  2. // AEAD, in bytes.
  3. NonceSize = 12
  5. // NonceSizeX is the size of the nonce used with the XChaCha20-Poly1305
  6. // variant of this AEAD, in bytes.
  7. NonceSizeX = 24

)

  2. - The idea of symmetric key is to pass messages and encrypt/decrypt with a generated symmetric key, while we encrypt/decrypt the same symmetric key with rsa keypairs.
  3. - With packs above, here is the set of new functions in crypting.go to do symmetric key crypting: 
  4. ```go
  5. // Encrypt with public key string instead of rsa.PublicKey, finally return ciphertext and error
  6. func EncryptWithPublicKeyStr(unencrypted []byte, pubkeystr string) ([]byte, error) {
  7.     pubkey := BytesToPublicKey([]byte(pubkeystr))
  9.     hash := sha1.New()
  10.     ciphertext, err := rsa.EncryptOAEP(hash, rand.Reader, pubkey, unencrypted, nil)
  11.     if err != nil {
  12.         logger.Error(err)
  13.     }
  15.     return ciphertext, err
  16. }
  18. // Decrypt with private key string instead of rsa.PrivateKey, finally return plaintext and error
  19. func DecryptWithPrivateKeyStr(encrypted []byte, pvtkeystr string) ([]byte, error) {
  20.     pvtkey := BytesToPrivateKey([]byte(pvtkeystr))
  22.     hash := sha1.New()
  23.     plaintext, err := rsa.DecryptOAEP(hash, rand.Reader, pvtkey, encrypted, nil)
  24.     if err != nil {
  25.         logger.Error(err)
  26.     }
  28.     return plaintext, err
  29. }
  31. // SymmKeyGen generates new symmetric key for sender
  32. func SymmKeyGen(length int) []byte {
  33.     key := make([]byte, KeySize)
  34.     if _, err := cryptorand.Read(key); err != nil {
  35.         panic(err)
  36.     }
  38.     return key
  39. }
  41. // EncryptMsg - encryption with symmetric key, and use rsa public key string to hide that symmetric key
  42. func EncryptMsg(msg []byte, pubkeystr string) ([]byte, []byte) {
  44.     keySymm := SymmKeyGen(KeySize) //generate a random symmetric key as sender
  46.     aead, err := chacha.NewX([]byte(keySymm)) //both sender and receiver do this step
  47.     if err != nil {
  48.         panic(err)
  49.     }
  51.     nonce := make([]byte, aead.NonceSize(), aead.NonceSize()+len(msg)+aead.Overhead())
  52.     if _, err := cryptorand.Read(nonce); err != nil {
  53.         panic(err)
  54.     }
  56.     encryptedMsg := aead.Seal(nonce, nonce, msg, nil) //encrypt message with symmetric key
  58.     encryptedKey, err := EncryptWithPublicKeyStr(keySymm, pubkeystr) //encrypt symmetric key with provided public key
  59.     if err != nil {
  60.         panic(err)
  61.     }
  63.     return encryptedMsg, encryptedKey
  64. }
  66. // DecryptMsg - symmetric decryption with symmetric key, while symmetric key is decrypted wih rsa private key string
  67. func DecryptMsg(encryptedMsg []byte, encryptedKey []byte, pvtkeystr string) ([]byte, error) {
  69.     keySymm, err := DecryptWithPrivateKeyStr(encryptedKey, pvtkeystr) //decrypt symmetric key with provided private key
  70.     if err != nil {
  71.         logger.Error(err)
  72.     }
  74.     aead, err := chacha.NewX([]byte(keySymm)) //both sender and receiver do this step
  75.     if err != nil {
  76.         panic(err)
  77.     }
  79.     if len(encryptedMsg) < aead.NonceSize() {
  80.         panic("ciphertext too short")
  81.     }
  83.     nonce, ciphertext := encryptedMsg[:aead.NonceSize()], encryptedMsg[aead.NonceSize():]
  85.     plaintext, err := aead.Open(nil, nonce, ciphertext, nil) //decrypt message with symmetric key
  86.     if err != nil {
  87.         panic(err)
  88.     }
  90.     return plaintext, err
  91. }

Test file (use both rsa keypairs and symmetric keys)

  1. package main
  3. import (
  4.     "fmt"
  6.     "ire.com/clustershell/crypting"
  7.     "ire.com/clustershell/crypting/keypairs"
  8.     "ire.com/clustershell/logger"
  10.     cryptorand "crypto/rand"
  11. )
  13. // Test - pick up key pairs from keys.go
  14. type Test struct {
  15.     pvtkeystrScheduler string
  16.     pubkeystrScheduler string
  17.     pvtkeystrExecutor  string
  18.     pubkeystrExecutor  string
  19. }
  21. var teststrings = `HelloWorld`
  23. //rsa logic: length of passing is in crypting.GenerateKeyPair(asymmetricKeySize) from generateKeyPairs.go
  24. func (t *Test) cryptingSimulationBoth(msg string) bool {
  25.     fmt.Println("message length: ", len(msg))
  27.     msgScheduler := msg
  28.     //fmt.Println("Scheduler: ", cryptingSimulation(msgScheduler, t.pubkeystrScheduler, t.pvtkeystrScheduler))
  29.     msgExecutor := msg
  30.     //fmt.Println("Executor: ", cryptingSimulation(msgExecutor, t.pubkeystrExecutor, t.pvtkeystrExecutor), "\n")
  32.     //return cryptingSimulation(msgScheduler, t.pubkeystrScheduler, t.pvtkeystrScheduler) && cryptingSimulation(msgExecutor, t.pubkeystrExecutor, t.pvtkeystrExecutor)
  33.     return cryptingSimulationSymm(msgScheduler, t.pubkeystrScheduler, t.pvtkeystrScheduler) && cryptingSimulationSymm(msgExecutor, t.pubkeystrExecutor, t.pvtkeystrExecutor)
  34. }
  36. //crypting with only rsa keypairs
  37. func cryptingSimulation(msg string, pubkeystr string, pvtkeystr string) bool {
  38.     encrypted, err := crypting.EncryptWithPublicKeyStr([]byte(msg), pubkeystr)
  39.     //fmt.Println(string(encrypted))
  40.     if err != nil {
  41.         logger.Error(err)
  42.     }
  44.     unencrypted, err := crypting.DecryptWithPrivateKeyStr(encrypted, pvtkeystr)
  45.     //fmt.Println(string(unencrypted))
  46.     if err != nil {
  47.         logger.Error(err)
  48.     }
  50.     return string(unencrypted) == msg
  51. }
  53. //crypting with both rsa keypairs and symmetric keys
  54. func cryptingSimulationSymm(msg string, pubkeystr string, pvtkeystr string) bool {
  55.     //pubkeystr and pvtkeystr here are rsa keys
  57.     //pubkeystr is used to encrypt the symmetric key into encryptedKey
  58.     encryptedMsg, encryptedKey := crypting.EncryptMsg([]byte(msg), pubkeystr)
  60.     //remember to pass encryptedKey and pvtkeystr to get the symmetric key
  61.     unencrypted, err := crypting.DecryptMsg(encryptedMsg, encryptedKey, pvtkeystr)
  62.     if err != nil {
  63.         logger.Error(err)
  64.     }
  66.     return string(unencrypted) == msg
  67. }
  69. func main() {
  70.     fmt.Println("\n", "kengen_crypt", "\n")
  72.     //fmt.Printf("Scheduler_private_key_byte_str\n%v", pvtkeystrScheduler)
  73.     //fmt.Printf("Scheduler_public_key_byte_str\n%v", pubkeystrScheduler)
  75.     //fmt.Printf("Executor_private_key_byte_str\n%v", pvtkeystrScheduler)
  76.     //fmt.Printf("Executor_public_key_byte_str\n%v", pubkeystrScheduler)
  78.     //get 2 keypairs in keys.go
  79.     test := Test{keypairs.PvtkeyScheduler, keypairs.PubkeyScheduler, keypairs.PvtkeyExecutor, keypairs.PubkeyExecutor}
  81.     //add 1000 bytes every time
  82.     str := make([]byte, 1000) 
  83.     cryptorand.Read(str)
  85.     for { //this loop can show the maximum length of the message passes
  86.         teststrings = teststrings + string(str)
  87.         if !test.cryptingSimulationBoth(teststrings) {
  88.             break
  89.         }
  90.     }
  92. }

Function in crypting.go:

  • GenerateKeyPair(int) (rsa.PrivateKey, rsa.PublicKey): return rsa privatekey and publickey according to provided length
  • PrivateKeyToBytes(*rsa.PrivateKey) []byte: convert rsa.PrivateKey to keybytes
  • PublicKeyToBytes(*rsa.PublicKey) []byte: convert rsa.PublicKey to keybytes
  • BytesToPrivateKey([]byte) *rsa.PrivateKey: convert keybytes to rsa.PrivateKey
  • BytesToPublicKey([]byte) *rsa.PublicKey: convert keybytes to rsa.PublicKey
  • EncryptWithPublicKey([]byte, *rsa.PublicKey) []byte: encrypt message with rsa public key, return ciphertext
  • DecryptWithPrivateKey([]byte, *rsa.PrivateKey) []byte: decrypt message with rsa private key, return plaintext
  • EncryptWithPublicKeyStr([]byte, string) ([]byte, error): encrypt message with rsa public key string, return ciphertext and error
  • DecryptWithPrivateKeyStr([]byte, string) ([]byte, error): encrypt message with rsa private key string, return plaintext and error
  • SymmKeyGen(int) []byte: return symmetric key according to provided length
  • EncryptMsg([]byte, string) ([]byte, []byte): encrypt message with randomly generated symmetric key, return encrypted message bytes and encrypted symmetric key that encrypted by provided rsa public key
  • DecryptMsg([]byte, []byte, string) ([]byte, error): decrypt symmetric key with provided rsa private key, and use this symmetric key to decrypt encrypted message, return plaintext and error