lib/silcclient, The Client Library
==================================
+ o UDP SILC connection support to SILC server
+
o Giving WHOIS for nick that doesn't exist should remove any same
named entries from the client cache.
o Structured log messages to Log API. Allows machine readable log
messages. Would allow sending of any kind of data in a log message.
- o Base64 to an own API
+ o Base64 to an own API (***DONE)
- o Timer API
+ o Timer API (***DONE)
o Add builtin SOCKS and HTTP Proxy support, well the SOCKS at least.
SILC currently supports SOCKS4 and SOCKS5 but it needs to be compiled
silc_snprintf(buf, sizeof(buf), "Client ID %@", id_renderer, client_id);
+ o Change silc_gettimeofday on Unix to use clock_gettime with REALTIME
+ clock if it is available, otherwise use gettimeofday().
+
(o Generic SilcStatus or SilcResult that includes all possible status and
error conditions, including those of SILC protocol. Though, the SILC
protocol related status (currently in silcstatus.h) cannot be in
==============================
o Add silc_crypto_init and silc_crypto_uninit. The _init should take
- SilcStack that will act as global memory pool for all of crypto
+ SilcStack that will act as global memory pool for all of crypto
library. It should not be necessary anymore to separately register
default ciphers, HMACs, etc, the _init would do that. However, if
user after _init calls silc_pkcs_register, for example, it would take
preference over the default once, ie. user can always dictate the
- order of algorithms.
-
- The global SilcStack should be used by all routines in lib/silccrypt,
- lib/silcacc (and lib/silcmath). lib/silcskr and lib/silcasn1 has support
- in the API for providing SilcStack, however, if not provided, they
- should look for global SilcStack, if SILC_DIST_CRYPTO is defined.
- Same SILC_DIST_CRYPTO ifdef for other libs.
+ order of algorithms. (***DONE)
o Add fingerprint to SilcSILCPublicKey and retrieval to silcpk.h, and
possibly to silcpkcs.h.
o Change SILC PKCS API to asynchronous, so that accelerators can be used.
All PKCS routines should now take callbacks as argument and they should
- be delivered to SilcPKCSObject and SilcPKCSAlgorithm too.
-
- /* Signature computation callback */
- typedef void (*SilcPKCSSignCb)(SilcBool success,
- const unsigned char *signature,
- SilcUInt32 signature_len,
- void *context);
-
- /* Signature verification callback */
- typedef void (*SilcPKCSVerifyCb)(SilcBool success, void *context);
-
- /* Encryption callback */
- typedef void (*SilcPKCSEncryptCb)(SilcBool success,
- const unsigned char *encrypted,
- SilcUInt32 encrypted_len,
- void *context);
-
- /* Decryption callback */
- typedef void (*SilcPKCSDecryptCb)(SilcBool success,
- const unsigned char *decrypted,
- SilcUInt32 decrypted_len,
- void *context);
-
- Either add new _async functions or add the callbacks to existing API
- and if the callback is NULL then the API is not async and if provided
- it may be async. For example;
-
- SilcBool silc_pkcs_sign(SilcPrivateKey private_key,
- unsigned char *src, SilcUInt32 src_len,
- unsigned char *dst, SilcUInt32 dst_size,
- SilcUInt32 *dst_len,
- SilcBool compute_hash, SilcHash hash,
- SilcPKCSSignCb async_sign,
- void *async_sign_context);
-
- (if this is done then there's no reason why the buffers in the
- callbacks cannot be the ones user gives here) or allow only async:
-
- SilcBool silc_pkcs_sign(SilcPrivateKey private_key,
- unsigned char *src, SilcUInt32 src_len,
- SilcBool compute_hash, SilcHash hash,
- SilcPKCSSignCb async_sign,
- void *async_sign_context);
-
- or add new:
-
- SilcBool silc_pkcs_sign_async(SilcPrivateKey private_key,
- unsigned char *src, SilcUInt32 src_len,
- SilcBool compute_hash, SilcHash hash,
- SilcPKCSSignCb async_sign,
- void *async_sign_context);
+ be delivered to SilcPKCSObject and SilcPKCSAlgorithm too. (***DONE)
o Change PKCS Algorithm API to take SilcPKCSAlgorithm as argument to
encrypt, decrypt, sign and verify functions. We may need to for exmaple
check the alg->hash, supported hash functions. Maybe deliver it also
- to all other functions in SilcPKCSAlgorithm to be consistent.
+ to all other functions in SilcPKCSAlgorithm to be consistent. (***DONE)
+
+ o Add DSA support to SILC public key.
- o Add DSS support. Take implementation from Tom or make it yourself.
+ o Add DSS support. (***DONE)
o Implement the defined SilcDH API. The definition is in
lib/silccrypt/silcdh.h. Make sure it is asynchronous so that it can
be accelerated. Also take into account that it could use elliptic
curves.
- o ECDSA and ECDH
+ o Add ECDSA support.
+
+ o Add ECDH support.
o All cipher, hash, hmac etc. allocation routines should take their name
- in as const char * not const unsigned char *.
+ in as const char * not const unsigned char *. (***DONE)
SILC Accelerator Library
o SILC Accelerator API. Provides generic way to use different kind of
accelerators. Basically implements SILC PKCS API so that SilcPublicKey
and SilcPrivateKey can be used but they call the accelerators.
-
- Something in the lines of (preliminary):
-
- /* Register accelerator to system. Initializes the accelerator. */
- Varargs are optional accelerator specific init parameteres. */
- SilcBool silc_acc_register(SilcAccelerator acc, ...);
-
- silc_acc_register(softacc, "min_threads", 2, "max_threads", 16, NULL);
-
- /* Unregister accelerator. Uninitializes the accelerator. */
- SilcBool silc_acc_unregister(const SilcAccelerator acc);
-
- /* Return list of the registered accelerators */
- SilcDList silc_acc_get_supported(void);
-
- /* Find existing accelerator. `name' is accelerator's name. */
- SilcAccelerator silc_acc_find(const char *name);
-
- /* Return accelerator's name */
- const char *silc_acc_get_name(SilcAccelerator acc);
-
- /* Accelerate `public_key'. Return accelerated public key. */
- SilcPublicKey silc_acc_public_key(SilcAccelerator acc,
- SilcPublicKey public_key);
-
- /* Accelerate `private_key'. Returns accelerated private key. */
- SilcPrivateKey silc_acc_private_key(SilcAccelerator acc,
- SilcPrivateKey private_key);
-
- /* Return the underlaying public key */
- SilcPublicKey silc_acc_get_public_key(SilcAccelerator acc,
- SilcPublicKey public_key);
-
- /* Return the underlaying private key */
- SilcPrivateKey silc_acc_get_private_key(SilcAccelerator acc,
- SilcPrivateKey private_key);
-
- typedef struct SilcAcceleratorObject {
- const char *name; /* Accelerator's name */
- SilcBool (*init)(va_list va); /* Initialize accelerator */
- SilcBool (*uninit)(void); /* Uninitialize accelerator */
- const SilcPKCSAlgorithm *pkcs; /* Accelerated PKCS algorithms */
- const SilcDHObject *dh; /* Accelerated Diffie-Hellmans */
- const SilcCipherObject *cipher; /* Accelerated ciphers */
- const SilcHashObject *hash; /* Accelerated hashes */
- const SilcHmacObject *hmac; /* Accelerated HMACs */
- const SilcRngObject *rng; /* Accelerated RNG's */
- } *SilcAccelerator, SilcAcceleratorStruct;
-
- Allows accelerator to have multiple accelerators (cipher, hash etc)
- and multiple different algorithms and implementations (SHA-1, SHA-256 etc).
-
- SilcPublicKey->SilcSILCPublicKey->RsaPublicKey accelerated as:
- SilcPublicKey->SilcAcceleratorPublicKey->SilcSoftAccPublicKey->
- SilcPublicKey->SilcSILCPublicKey->RsaPublicKey
-
- silc_acc_public_key creates SilcPublicKey and SilcAcceleratorPublicKey
- and acc->pkcs->import_public_key creates SilcSoftAccPublicKey.
+ (***DONE)
o Implement software accelerator. It is a thread pool system where the
- public key and private key operations are executed in threads.
-
- const struct SilcAcceleratorObject softacc =
- {
- "softacc", softacc_init, softacc_uninit,
- softacc_pkcs, NULL, NULL, NULL, NULL
- }
+ public key and private key operations are executed in threads.
+ (***DONE)
- /* Called from silc_acc_private_key */
- int silc_softacc_import_private_key(void *key, SilcUInt32 key_len,
- void **ret_private_key)
- {
- SilcSoftAccPrivateKey prv = silc_calloc(1, sizeof(*prv));
- prv->pkcs = acc->pkcs;
- prv->private_key = key;
- *ret_private_key = prv;
- }
+ o Diffie-Hellman acceleration
(o Symmetric key cryptosystem acceleration? They are always sycnhronouos
even with hardware acceleration so the crypto API shouldn't require
lib/silcmath
============
- o Import TFM. Talk to Tom to add the missing functions. Use TFM in
- client and client library, but TMA in server, due to the significantly
- increased memory consumption with TFM, and the rare need for public
- key operations in server.
+ o Import TFM. We want TFM's speed but its memory requirements are
+ just too much. By default it uses large pre-allocated tables which
+ will eat memory when there are thousands of public keys in system.
+ We probably want to change TFM's fp_int dynamic so that a specific
+ size can be allocated for the int. We could have two new functions:
- We want TFM's speed but not TFM's memory requirements. Talk to Tom
- about making the TFM mp dynamic just as it is in LTM.
+ SilcBool silc_mp_init_size(SilcMPInt *mp, SilcUInt32 bit_size);
+ SilcBool silc_mp_sinit_size(SilcStack stack, SilcMPInt *mp,
+ SilcUInt32 bit_size);
+
+ Which by default allocates `bit_size' bits instead of some default
+ value. silc_mp_init would allocate the default FP_SIZE with TFM
+ and do normal init with TMA and GMP. _init_size with TMA and GMP
+ would be same as _init.
+
+ o Add AND, OR and XOR support to TFM or ask Tom to do it.
o The SILC MP API function must start returning indication of success
and failure of the operation.
o SILC_ASN1_CHOICE should perhaps return an index what choice in the
choice list was found. Currently it is left for caller to figure out
- which choice was found.
+ which choice was found. (***DONE)
o SILC_ASN1_NULL in decoding should return SilcBool whether or not
the NULL was present. It's important when it's SILC_ASN1_OPTIONAL
- and we need to know whether it was present or not.
+ and we need to know whether it was present or not. (***DONE)
lib/silcpgp
===========
- o OpenPGP certificate support, allowing the use of PGP public keys
- in SILC.
+ o OpenPGP certificate support, allowing the use of PGP public keys.
lib/silcssh
===========
- o SSH2 public key/private key support, allowing the use of SSH2 keys
- in SILC. RFC 4716.
+ o SSH2 public key/private key support, allowing the use of SSH2 keys.
+ RFC 4716. (***DONE)
lib/silcpkix
o Library must have support for SERVICE command.
+ o Both UDP and TCP support for incoming connecetions. Maintaining long
+ term UDP sessions.
+
o The server must be able to run behind NAT device. This means that
Server ID must be based on public IP instead of private IP.