.TH SECURITY-OLDAUTH 2.SH NAMEoldauth: certtostr, pktostr, sktostr, strtocert, strtopk, strtosk, sign, verify, readauthinfo, writeauthinfo \- encoding for original Inferno authentication protocol.SH SYNOPSIS.EXinclude "ipints.m";include "crypt.m";include "oldauth.m";oldauth := load Oldauth Oldauth->PATH; Certificate: adt{    sa:     string;    ha:     string;    signer: string;    exp:    int;    sig:    ref Crypt->PKsig;}; Authinfo: adt{    mysk:   ref Crypt->SK;    mypk:   ref Crypt->PK;    owner:  string;    cert:   ref Certificate;    spk:    ref Crypt->PK;    alpha:  ref IPints->IPint;    p:      ref IPints->IPint;}; sign:   fn (sk: ref Crypt->SK, signer: string, exp: int,          state: ref Crypt->DigestState, ha: string): ref Certificate;verify: fn (pk: ref Crypt->PK, cert: ref Certificate,          state: ref Crypt->DigestState): int; strtocert: fn(s: string): ref Certificate;certtostr: fn(c: ref Certificate): string;strtopk:   fn(s: string): (ref Crypt->PK, string);pktostr:   fn(pk: ref Crypt->PK, owner: string): string;strtosk:   fn(s: string): (ref Crypt->SK, string);sktostr:   fn(sk: ref Crypt->SK, owner: string): string; readauthinfo:   fn(filename: string): ref Authinfo;writeauthinfo:  fn(filename: string, info: ref Authinfo): int;.EE.SH DESCRIPTIONCertificates, public keys, and private keys are passed over networks and between applications using a Unicode representation.This collection of functions provide a means to convert adts supplied by the system to and from their portable textual representation. These routines are used by.IR login (2)and.IR factotum (4)to implement the Inferno authentication protocol..PPPublic and private keys are represented by.B Crypt->PKand.B Crypt->SK(see.IR keyring-intro (2)).An authentication domain is represented bythe public key of the domain's.IR signer ,typically in control of a.IR keyfs (4)and running a.IR logind (8).Two adts associate a public/private key pair with a user name within a specific authentication domain:.TP.B AuthinfoThe.B Authinfoadt contains an individual user's private and public key, a human-readable name for the key (eg, a user name),the signer's certificateand the signer's public key, and the Diffie-Hellman parameters.The signer's certificate binds the user's public key to the given key name in the signer's domain..TP.B CertificateThe.B Certificateadt contains a digital signature with the certification of the trusted authority (CA).The signature covers not only the user's public key, but the key's name, the signer's name andthe expiration time of the certificate.Both the key's name and the signer's name are local to the signer's domain..PP.B Initmust be called before using any other operation in the module..PP.B Signreturns a Certificate containing the digital signature using secret key.I skof a digest's.IR state ,which is the output of the hash algorithm named.IR ha ,combined with the hash of the signer's name, and the certificate's expiration time (in seconds from the Epoch).Valid hash algorithms are.B sha1and.BR md5 .The expiry time should be zero if the certificate does not expire.Typically the.I stateis the result of hashing.IP.EXarray of byte pktostr(pk, username).EE.PPfor a given public key.I pkthat is associated with the given.I usernameby the signer..PP.B Verifychecks that the given Certificate is the result of signing the given.I stateusing the secret (private) key corresponding to public key.IR pk .It returns true (non-zero) if the certificate is valid, including the signer's name, and the expiration time;the caller must enforce the expiration time if desired.It returns false (zero) if the certificate is invalid..	#######.PP.B Signcreates a digital signature of a digest from the concatenation of: a message, the name of the signer, and an expiration time..I Stateis the digest state after running.BR sha1 ,.B md4or.B md5over the message..I Hais a string specifying the hash algorithm to use:.B"sha"\fR,.B"sha1"\fR,.B"md4"\fRor.B"md5"\fR..B Signextends the digest to cover the signer's name(taken from the private key,.IR sk )and the expiration time.It returns a certificate containing the digital signature of the digest, signer name, hash algorithm and signature algorithm.If any parameter is invalid,.B signreturns nil.The signature algorithm is implied by the type of the private key..PP.B Verifyuses public key.I pkto verify a certificate.It returns non-zero (true) if the certificate is valid; zero (false) otherwise..I Stateis the digest state after running the chosen digest algorithmover the message..	#######.PPThe remaining operations fetch and store those values and convert to and from text representations for use in protocols and for storage..PP.B Strtocerttakes a string argument containing a varying number of newline-separated fields:a signature algorithm, a hash algorithm, a signer's name, an expiration time, and values representing a digital signature.It returns the corresponding.BR Certificate .If the string is of improper format, the result is.IR nil ..PP.B Certtostrperforms the inverse operation: takes the.B Certificate.I cand produces a text string suitable for communication over a network.Note that the string will contain newline characters..PP.B Strtopkand.B strtosktake as their arguments a string.I srepresenting the public and private keys respectively..I Scontains an algorithm name, a user name and values representing the key.Each returns a tuple.BI ( k,\ s ),where.I kis the resulting key value (ie,.B Crypt->PKor.BR Crypt->SK )and.I sis a string giving the name associated with the key, typically a user name.If the format of.I sis invalid,.I kis.IR nil ,and.I scontains a diagnostic..PP.B Pktostrand.B sktostrperform the inverse operations:they take a public key (secret key).I pkor.IR sk ,the.I ownername to be associated with that key, and produce a printable representation as a string.The.I ownernames the user that owns the key; in the case of a public key,the user is expected to possess the corresponding private key..PP.B Readauthinforeads a representation of an.B Authinfofrom a file.It returns nil if there is a read error or a conversion error;it returns a reference to the.B Authinfootherwise..PP.B Writeauthinfowrites a representation of.I infoto a file. It returns -1 if the write operation fails, 0 otherwise..SH SOURCE.B /appl/lib/oldauth.b.SH SEE ALSO.IR crypt-intro (2),.IR ipints (2),.IR security-intro (2)