Problem - Kevin Tafuro

With a valid socket descriptor in hand, you can now use the exchanged key to set up
a secure channel, as discussed in Recipe 9.12. When you are finished communicating,
you may simply close the socket descriptor.
Whether or not the connection succeeds, AX_exchange( ) automatically deallocates
the AX object passed into it. If the exchange does fail, the connection to the server
will need to be reestablished by calling AX_connect( ) a second time.
See Also
• AX home page: http://www.zork.org/ax/
• Recipes 4.10, 9.12, 13.1
8.16 Performing Authenticated Key Exchange
Using RSA
Problem
Two parties in a network communication want to communicate using symmetric
encryption. At least one party has the RSA public key of the other, which was either
transferred in a secure manner or will be validated by a trusted third party.
You want to do authentication and key exchange without any of the information
leakage generally associated with password-based protocols.
Solution
Depending on your authentication requirements, you can do one-way authenticating
key transport, two-way authenticating key transport, or two-way authenticating
key agreement.
Discussion
Instead of using this recipe to build your own key establishment protocols,
it is much better to use a preexisting network protocol such as
SSL/TLS (see Recipes 9.1 and 9.2) or to use PAX (Recipe 8.15) alongside
the secure channel code from Recipe 9.12.
With key transport, one entity in a system chooses a key and sends it to the entity
with which it wishes to communicate, generally by encrypting it with the RSA public
key of that entity.
Performing Authenticated Key Exchange Using RSA | 429
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.