AT_CLEANUP
+###--------------------------------------------------------------------------
+### Key management.
+
+AT_SETUP([server key-management])
+AT_KEYWORDS([keymgmt])
+export TRIPE_SLIPIF=USLIP
+
+## Determine all of the nets and the principals.
+princs=""
+nets=" "
+while read princ pnets; do
+ princs="$princs $princ"
+ for n in $pnets; do
+ case " $nets " in *" $n "*) ;; *) nets="$nets$n " ;; esac
+ done
+done <<PRINC
+alice alpha beta
+bob alpha beta
+carol beta
+PRINC
+
+## Build the master keyring. All key tags here are of the form PRINC/NET.
+for n in $nets; do
+ key -k$abs_top_srcdir/t/keyring-$n extract keyring-$n $princs
+ for p in $princs; do key -kkeyring-$n tag $p $p/$n; done
+ key merge keyring-$n
+ rm keyring-$n
+done
+key extract -f-secret keyring.pub
+
+## Set up the principals' directories.
+for p in $princs; do
+ mkdir $p
+ cp keyring keyring.pub $p/
+done
+
+WITH_3TRIPES([alice], [bob], [carol], [-nslip -Tmx],
+ [-talice/alpha], [-tbob/alpha], [-tcarol/beta], [
+
+ ## Establish this little merry-go-round.
+ ESTABLISH([alice], [alice], [-key alice/alpha],
+ [bob], [bob], [-key bob/alpha])
+ ESTABLISH([alice], [alice], [-key alice/beta],
+ [carol], [carol], [-priv alice/beta -key carol/beta])
+ ESTABLISH([bob], [bob], [-key bob/beta],
+ [carol], [carol], [-priv bob/beta -key carol/beta])
+
+ ## Tweak Bob's alpha key.
+ for p in $princs; do
+ TRIPECTL -d$p WARN test COMMENT tweak bob/alpha
+ done
+
+ key -k$abs_top_srcdir/t/keyring-alpha extract keyring-bob-new bob-new
+ key merge keyring-bob-new
+ key tag -r bob-new bob/alpha
+ key extract -f-secret keyring.pub
+ for p in alice bob; do cp keyring keyring.pub $p/; done
+
+ ## Kick the peers to see whether they update.
+ AWAIT_KXDONE([alice], [alice], [bob], [bob], [
+ TRIPECTL -dalice RELOAD
+ TRIPECTL -dbob RELOAD
+ TRIPECTL -dalice FORCEKX bob
+ TRIPECTL -dbob FORCEKX alice
+ ])
+
+ COMMS_EPING([alice], [alice], [bob], [bob])
+ COMMS_EPING([bob], [bob], [alice], [alice])
+
+ ## Update the beta ring.
+ key merge $abs_top_srcdir/t/keyring-beta-new
+ for p in $princs; do key tag -r $p $p/beta; done
+ key extract -f-secret keyring.pub
+
+ ## Update alice's and carol's private keys, bob's public. This should be
+ ## insufficient for them to switch, but the results could be interesting.
+ for p in $princs; do
+ TRIPECTL -d$p WARN test COMMENT tweak beta step 1
+ done
+
+ for p in alice carol; do cp keyring $p/; done
+ cp keyring.pub bob/
+ for p in $princs; do TRIPECTL -d$p RELOAD; done
+
+ AT_DATA([algs-alpha], [dnl
+kx-group=ec kx-group-order-bits=256 kx-group-elt-bits=512
+hash=rmd160 mgf=rmd160-mgf hash-sz=20
+cipher=blowfish-cbc cipher-keysz=20 cipher-blksz=8
+cipher-data-limit=67108864
+mac=rmd160-hmac mac-keysz=20 mac-tagsz=10
+])
+
+ AT_DATA([algs-beta-old], [dnl
+kx-group=prime kx-group-order-bits=160 kx-group-elt-bits=1023
+hash=rmd160 mgf=rmd160-mgf hash-sz=20
+cipher=blowfish-cbc cipher-keysz=20 cipher-blksz=8
+cipher-data-limit=67108864
+mac=rmd160-hmac mac-keysz=20 mac-tagsz=10
+])
+
+ AT_DATA([algs-beta-new], [dnl
+kx-group=ec kx-group-order-bits=161 kx-group-elt-bits=320
+hash=rmd160 mgf=rmd160-mgf hash-sz=20
+cipher=blowfish-cbc cipher-keysz=20 cipher-blksz=8
+cipher-data-limit=67108864
+mac=rmd160-hmac mac-keysz=20 mac-tagsz=10
+])
+
+ cp algs-alpha expout; AT_CHECK([TRIPECTL -dalice ALGS],, [expout])
+ cp algs-beta-old expout; AT_CHECK([TRIPECTL -dalice ALGS carol],, [expout])
+ cp algs-beta-old expout; AT_CHECK([TRIPECTL -dbob ALGS carol],, [expout])
+ cp algs-beta-new expout; AT_CHECK([TRIPECTL -dcarol ALGS],, [expout])
+ cp algs-beta-old expout; AT_CHECK([TRIPECTL -dcarol ALGS alice],, [expout])
+
+ ## Now copy the full keys. We expect this to provoke key exchange.
+ for p in $princs; do
+ TRIPECTL -d$p WARN test COMMENT tweak beta step 2
+ done
+
+ for p in $princs; do cp keyring keyring.pub $p/; done
+
+ AWAIT_KXDONE([alice], [alice], [carol], [carol], [
+ TRIPECTL -dalice RELOAD
+ AWAIT_KXDONE([bob], [bob], [carol], [carol], [
+ TRIPECTL -dbob RELOAD
+ TRIPECTL -dcarol RELOAD
+ ])
+ ])
+
+ cp algs-alpha expout; AT_CHECK([TRIPECTL -dalice ALGS],, [expout])
+ cp algs-beta-new expout; AT_CHECK([TRIPECTL -dalice ALGS carol],, [expout])
+ cp algs-beta-new expout; AT_CHECK([TRIPECTL -dbob ALGS carol],, [expout])
+ cp algs-beta-new expout; AT_CHECK([TRIPECTL -dcarol ALGS],, [expout])
+])
+
+AT_CLEANUP
+
###--------------------------------------------------------------------------
### Services.
65604204:tripe-ec:bob struct:[p=ec,public:0x6df064afcdc923160114d2919f014bcef1051bf5cb3071194088a10be4f0c992,0xea0f0b538cb3ad46d07d9b83eff95458b691bdfbf09188ccd7b0758bebd8f107,private=struct:[x=integer,private,burn:26559628286452801356420934030260728558957937100654818426187327519091722521190],curve=string,shared:nist%2dp256] forever forever -
b10d3366:tripe-ec-param struct:[curve=string,shared:nist%2dp256] forever forever -
+1aac2ad7:tripe-ec:bob-new struct:[p=ec,public:0xebf0cb581592dc6244a47e9d2e6bc79f76ecb9e5f6e34d69f9f0d07eab188351,0xa6ec5ff761242a0eef1565fd7a6604dbab7b4a0552226b60f2359bccd3e80f48,private=struct:[x=integer,private,burn:15276384741843750980963471236080551062792600396841148726840678168354415102951],curve=string,shared:nist%2dp256] forever forever -
ec1faca7:tripe-ec:alice struct:[p=ec,public:0xa886b00e1457196c1fd91f11a94cf4a081169602c5e2b576d4182eca470ec253,0xb0fa9a01d4205c912d97c4b4c8d8c5e0af869bd7cdef2139aff7579ca590b4c2,private=struct:[x=integer,private,burn:27337377592101678962721737273774069706724348359128065055711824790983665511674],curve=string,shared:nist%2dp256] forever forever -
73bad30f:tripe-ec:carol struct:[p=ec,public:0xac7b854c5e38a74a005a8940cfe7e9cac692bfb12316de782167632b38ced9fc,0xc4467936d15ba07f4ca5e6a7bbf2afb526dec70de0f0ad78f74010e0998a66cd,private=struct:[x=integer,private,burn:62821717637637708743367607162182045550925703241285672642684065475493697147942],curve=string,shared:nist%2dp256] forever forever -
~mdw / tripe / commitdiff