DTN2 uses OpenSSL to perform the cryptographic operations. In order to provide the Cryptographic Message Syntax (CMS) support required for BSP, we require OpenSSL version 1.0.0. For directions on installing OpenSSL see the OpenSSL homepage.
To configure DTN2 with BSP enabled:
$ ./configure --with-bsp LIBS="-ldl" --with-openssl=<path to openssl>
By default, OpenSSL is installed in /usr/local/ssl. Now DTN2 should build as usual.
We can also use OpenSSL to generate the RSA keys needed for BSP.
To generate an RSA key pair and save the private key to the file privkey.pem:
$ openssl genrsa -out privkey.pem <key length in bits>
To display the public key:
$ openssl rsa -in privkey.pem -modulus
To generate a self-signed certificate (for testing):
$ openssl req -new -x509 -key privkey.pem -out cert.pem
The format we use for RSA private keys:
$ cat privkey.pem cert.pem > RSA_enc_priv_key.pem
Once DTN2 has been compiled with BSP, it can be configured using the security command at the tcl shell. To list all the security commands, with a brief description of each:
dtn% help security
To turn on one of the security blocks for outgoing bundles:
dtn% security outgoing <bab|pib|pcb|esb> <ciphersuite number>
To use the ciphersuites defined in BSP:
dtn% security outgoing bab 1 dtn% security outgoing pib 2 dtn% security outgoing pcb 3 dtn% security outgoing esb 4
To turn off one of the blocks, use a ciphersuite number 0:
dtn% security outgoing pib 0
To turn off all of the security blocks for outgoing bundles:
dtn% security outgoing reset
We can also require all incoming bundles to have certain security blocks:
dtn% security incoming <bab | pib | pcb> [allowed ciphersuite number]
To use the ciphersuites defined in BSP:
dtn% security incoming bab 1 dtn% security incoming pib 2 dtn% security incoming pcb 3
To turn off the requirements for a particular block, use a ciphersuite value of 0:
dtn% security incoming pib 0
To turn off the requirements for all the blocks:
dtn% security incoming reset
To display the current security configuration for outgoing and incoming bundles:
dtn% security listpolicy
To set a 20-byte symmetric key, which is used by BAB, use the command:
dtn% security setkey <host> <ciphersuite number> <key>
Example:
dtn% security setkey node1.dtn 1 abcd1234abcd1234abcd1234abcd1234abcd1234
We could also use the wildcard * in place of the EID.
To display all the symmetric keys:
dtn% security dumpkeys
To erase all the symmetric keys:
dtn% security flushkeys
The default directory for storing public key certificates is /usr/local/ssl/certs/. To change the directory where certificates are stored (the name must end with "/"):
dtn% security certdir <directory containing certificates>
The default directory for storing private keys is /usr/local/ssl/private/. To change the directory where private keys are stored (the name must end with "/"):
dtn% security privdir <directory containing private keys>
To set the file name for public and private keys:
dtn% security keypaths [pub_keys_enc | priv_keys_dec | priv_keys_sig | pub_keys_ver] <ciphersuite number> <file name>
For example, if our RSA signature key is stored in "my_priv_key.pem", we would set this via:
dtn% security keypaths priv_keys_sig 2 my_priv_key.pem
The RSA private keys for signature and encryption must have the private key, followed by the certificate for that key. If the value <NODE> is used in the file name, it will be replaced with the EID.
To list the directories and file names for the public and private keys:
dtn% security listpaths
The default values for these variables are as follows.
certdir = /usr/local/ssl/certs/ privdir = /usr/local/ssl/private/ priv_keys_dec: (cs num 3) => RSA_enc_priv_key.pem (cs num 4) => RSA_enc_priv_key.pem pub_keys_enc: (cs num 3) => RSA_enc_cert_<NODE>.pem (cs num 4) => RSA_enc_cert_<NODE>.pem pub_keys_ver: (cs num 2) => RSA_sig_cert_<NODE>.pem priv_keys_sig: (cs num 2) => RSA_sig_priv_key.pem