Securing a Library System with TLS and OpenSSL: Networks Assignment Guide

Introduction: Why Security Matters in Network Applications

In today's digital world, securing network communications is as critical as locking the doors to a physical library. Just as Captain Haddock and Professor Calculus defend their ship's library from digital pirates, you must protect your applications from unauthorized access and data breaches. This tutorial builds on a basic library book management system by adding robust security features: TLS 1.3 for encrypted communication, secure password generation and storage, and an authentication protocol. These are essential skills for any cybersecurity-minded developer, especially in an era where data breaches make headlines daily.

Whether you're a student tackling a networks assignment or a developer looking to harden your applications, understanding OpenSSL and secure coding practices is invaluable. Let's dive into the key components.

1. Setting Up TLS 1.3 with OpenSSL

Transport Layer Security (TLS) ensures that data transmitted between client and server remains confidential and tamper-proof. OpenSSL is the go-to library for implementing TLS in C/C++ applications. For this tutorial, we'll use TLS 1.3, the latest version offering improved security and performance.

Generating Self-Signed Certificates

Before coding, you need a certificate and private key. Use OpenSSL's command-line tool to generate them:

openssl req -x509 -newkey rsa:2048 -keyout p3server.key -out p3server.crt -days 365 -nodes

This creates a self-signed certificate valid for one year. Name the files p3server.key and p3server.crt as required.

Configuring the TLS Context

In your server code, initialize the OpenSSL library and create an SSL context:

SSL_CTX *ctx = SSL_CTX_new(TLS_server_method());
SSL_CTX_set_min_proto_version(ctx, TLS1_3_VERSION);
SSL_CTX_set_max_proto_version(ctx, TLS1_3_VERSION);
SSL_CTX_set_ciphersuites(ctx, "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256");
SSL_CTX_use_certificate_file(ctx, "p3server.crt", SSL_FILETYPE_PEM);
SSL_CTX_use_PrivateKey_file(ctx, "p3server.key", SSL_FILETYPE_PEM);

This restricts the connection to TLS 1.3 and uses strong cipher suites. The client must also be configured similarly using TLS_client_method().

2. Implementing a Secure Login System

Replace the old HELO command with a two-step authentication: USER and PASS. The server first receives the username, then waits for the password. If the username is unknown, follow the New User Registration Protocol.

New User Registration Protocol

When a new user connects, generate a secure random password and salt. Use OpenSSL's RAND_bytes() for randomness:

unsigned char password[5];
RAND_bytes(password, 5);
// Ensure complexity: at least one uppercase, one number, one symbol

Check password strength and regenerate if needed. Then store the username, salt, and hashed password in a hidden file .book_shadow in the format username:salt:salted_password_hash. Encrypt the password using the pre-shared key (e.g., F24447TG) before sending it to the client. The client decrypts and displays the password.

3. Salting and Hashing Passwords

To defend against rainbow table attacks, always salt passwords. Use a unique 6-character salt for each user. The interleaving method combines salt and password: alternate salt and password characters starting with the first salt character. For example, salt S1a2tX and password P4s5w become SP14as25twX.

Then hash the salted password with SHA-512:

unsigned char hash[SHA512_DIGEST_LENGTH];
SHA512((unsigned char*)salted_password, strlen(salted_password), hash);

Store the hash as a hexadecimal string in .book_shadow.

4. Authentication Protocol

When a returning user sends their password, the server decrypts it using the pre-shared key, retrieves the user's salt from .book_shadow, salts the provided password using interleaving, hashes it, and compares it to the stored hash. If they match, authentication succeeds.

This ensures that plaintext passwords are never transmitted over the network. The pre-shared key encrypts the password before sending, and the server decrypts it for verification.

5. Handling Multiple Concurrent Clients

Your server must handle multiple clients simultaneously. Use threading (e.g., pthreads) or non-blocking I/O. Since shared memory solutions from P1 may cause issues, switch to a file-based approach for storing book data. Each client gets its own SSL connection, and the server can fork or use threads to manage them.

6. Practical Tips and Common Pitfalls

OpenSSL Versions: Ensure you use OpenSSL 3.2.2+ as specified. Different library packages (libssl-dev, openssl) may exist; check with openssl version.
Certificate Verification: For self-signed certificates, clients may skip verification in testing, but in production, always validate certificates.
Randomness: Use RAND_bytes() for cryptographic randomness. Avoid rand() or random() as they are not cryptographically secure.
Memory Management: Free SSL objects and contexts to avoid leaks.

Conclusion

By implementing TLS 1.3, secure password generation, salting, and hashing, you've transformed a basic library system into a fortress against digital pirates. These skills are directly applicable to real-world network programming and cybersecurity roles. As you continue learning, explore topics like certificate authorities, perfect forward secrecy, and OAuth for even stronger security.

Remember, the best defense is a layered approach. Keep your code updated, use strong cryptographic practices, and always stay curious. Happy coding, and may your library remain safe from scurvy pirates!