Changes between Version 2 and Version 3 of ProofOfOwnership


Ignore:
Timestamp:
Feb 12, 2019, 6:45:28 AM (6 years ago)
Author:
Richard
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • ProofOfOwnership

    v2 v3  
    11= Proof of Account Ownership =
    2 Provides your users a proof of BOINC project account ownership using OpenSSL public key cryptography. The user enters a message and that is signed alongside their account ID using the project's private key, proving that the user owns the account to external systems.
     2Provides your users a proof of BOINC project account ownership using OpenSSL public key cryptography.
     3
     4The user enters a message which is signed alongside their account ID using the project's private key, providing a standardized proof of account ownership to external systems.
     5
     6This is an optional extension to the BOINC web server.
    37
    48== User guide ==
    5 1. Login then navigate to the 'Proof of Account Ownership' page.[[BR]]2. Enter the message you wish to be signed.[[BR]]3. Complete the captcha then submit the form.[[BR]]4. A text box will appear, copy the contents.
     9=== Instructions ===
     10 1. Login then navigate to the 'Proof of Account Ownership' page.
     11 1. Enter the message you wish to be signed alongside your account ID.
     12 1. Complete the captcha then submit the form.
     13 1. A text box will appear, copy and save the full contents to an xml file.
    614
     15=== Example XML output ===
     16{{{
     17<account_ownership_verification>
     18<master_url>http://domain.tld/project_name/</master_url>
     19<msg>1 Enter text</msg>
     20<signature>BASE64_SIGNED_MSG</signature>
     21</account_ownership_verification>
     22}}}
    723== Project administrator guide ==
    8 Changes required to integrate this functionality:
    9 
    10 1. Have the latest stable OpenSSL installed on your BOINC web server.[[BR]]2. Install the latest  BOINC PR2965 web server changes:
    11 
     24=== Changes to web server ===
    1225{{{
    1326html/inc/util.inc - fixing ttok warnings
    … …  
    1831html/user/account_ownership_form.php - new file
    1932}}}
    20 3. Configure reCAPTCHA for the form.[[BR]]4. Generate OpenSSL keys in the /project/keys/ folder:
     33=== Changes required to integrate this functionality: ===
     34 1. Have the latest stable OpenSSL installed on your BOINC web server.
     35 1. Install the latest  BOINC PR2965 web server changes
     36 1. Configure reCAPTCHA for the form.
     37 1. Generate OpenSSL keys in the /project/keys/ folder:
    2138
    2239{{{
    … …  
    2441openssl rsa -pubout -in ownership_sign_private.pem -out ownership_sign_public.pem
    2542}}}
    26 5. Adjust key permissions:
     43 5. Adjust key permissions:
    2744
    2845{{{
    … …  
    3148chmod --reference upload_private ownership_sign_private.pem
    3249}}}
    33 6. Try the form, sign a message, attempt to verify the message using your public key and the decoded base64 message from the form.
     50 6. Try the form, sign a message, attempt to verify the message using your public key and the decoded base64 message from the form.
    3451
    35 == Security ==
     52=== Security ===
    3653The private key needs to remain on the web server, however if this key is compromised then proof of account ownership could be forged. It's important to maintain an updated and secure BOINC project web server to reduce the risk of this happening.
    3754
    38 If you believe that the private key has been compromised, then simply generate a new key pair to start from scratch, users will need to regenerate their signed messages.
     55If you believe that the private key has been compromised,  simply generate a new key pair to start from scratch, users will need to regenerate their signed messages to maintain a current proof of account ownership on external systems.
     56
     57----
     58== Verifying signed messages ==
     59=== Pre-requisites ===
     60Follow the above user guide with your project, copy the output XML text snippet and save to 'xml_data.xml'.
     61
     62Extract the PUBLIC_KEY_VALUE from the XML output produced by 'get_project_config.php' into a file called 'ownership_sign_public.pem'. Don't include the 'ownership_signature_public_key' tags in the file, don't include trailing return/newline characters in the text file.
     63
     64{{{
     65<ownership_signature_public_key>PUBLIC_KEY_VALUE</ownership_signature_public_key>
     66}}}
     67=== Python verification script ===
     68The below script takes the public key and the saved xml file and prints whether it's valid or not. Requires the following python modules: pycryptodome, base64, xmltodict
     69
     70{{{
     71from Crypto.PublicKey import RSA # package: pycryptodome
     72from Crypto.Signature import PKCS1_v1_5
     73from Crypto.Hash import SHA512
     74from base64 import b64decode
     75import xmltodict # For handling XML data
     76
     77with open('xml_data.xml') as fd: # Entire output XML snippet
     78    boinc_xml_data = xmltodict.parse(fd.read())
     79
     80with open('ownership_sign_public.pem') as f: # public key *.pem file
     81    public_key_data = f.read()
     82
     83message = boinc_xml_data['account_ownership_verification']['msg']
     84signature = boinc_xml_data['account_ownership_verification']['signature']
     85
     86rsakey = RSA.importKey(public_key_data)
     87verifier = PKCS1_v1_5.new(rsakey)
     88digest = SHA512.new()
     89digest.update(bytes(message, encoding = "utf8"))
     90
     91if verifier.verify(digest, b64decode(signature)):
     92    print("Successfully verified Account Ownership.")
     93else:
     94    print("Failed to verify UserID ownership.")
     95
     96}}}
     97=== Linux command line ===
     98Create the following bash script with filename 'verify.sh'.
     99
     100{{{
     101#!/bin/bash
     102SIG=$(sed -n 's/<signature>\(.*\)<\/signature>/\1/p' xml_data.xml)
     103MSG=$(sed -n 's/<msg>\(.*\)<\/msg>/\1/p' xml_data.xml)
     104echo -n $SIG > signature.txt
     105echo -n $MSG > msg.txt
     106base64 -d signature.txt > decoded_signature.txt
     107openssl dgst -sha512 -verify ownership_sign_public.pem -signature decoded_signature.txt msg.txt
     108}}}
     109Enable it to be executable then run the script
     110
     111{{{
     112chmod +x verify.sh
     113./verify.sh
     114
     115}}}
     116Expected successful output:
     117
     118{{{
     119Verified OK
     120}}}