{"id":30260666,"url":"https://github.com/yehoanatnezra/cipherchannel","last_synced_at":"2025-08-15T19:54:27.075Z","repository":{"id":308929532,"uuid":"1034551391","full_name":"YehoanatnEzra/CipherChannel","owner":"YehoanatnEzra","description":"Design and implementation of a simple VPN for secure comunication between computer and server over an encrypted channel. This VPN provides confidentiality, integrity and mutual authentication.","archived":false,"fork":false,"pushed_at":"2025-08-08T18:31:57.000Z","size":160,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-08-08T19:26:35.412Z","etag":null,"topics":["aes-cbc","cybersecurity","diffie-hellman","encryption-decryption","hash256","hiffiehel","hmac","midm","rachet","vpn"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/YehoanatnEzra.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-08-08T15:15:19.000Z","updated_at":"2025-08-08T18:32:01.000Z","dependencies_parsed_at":"2025-08-08T19:26:36.634Z","dependency_job_id":"d9a6022a-3390-4eea-a41c-a5aa953bff35","html_url":"https://github.com/YehoanatnEzra/CipherChannel","commit_stats":null,"previous_names":["yehoanatnezra/ciphertunnel"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/YehoanatnEzra/CipherChannel","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/YehoanatnEzra%2FCipherChannel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/YehoanatnEzra%2FCipherChannel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/YehoanatnEzra%2FCipherChannel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/YehoanatnEzra%2FCipherChannel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/YehoanatnEzra","download_url":"https://codeload.github.com/YehoanatnEzra/CipherChannel/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/YehoanatnEzra%2FCipherChannel/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270624094,"owners_count":24618261,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-15T02:00:12.559Z","response_time":110,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aes-cbc","cybersecurity","diffie-hellman","encryption-decryption","hash256","hiffiehel","hmac","midm","rachet","vpn"],"created_at":"2025-08-15T19:54:26.454Z","updated_at":"2025-08-15T19:54:27.063Z","avatar_url":"https://github.com/YehoanatnEzra.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# There is a man in the middle!!\n\nThis project implements a secure messaging channel protocol inspired by modern cryptographic ratchet designs, featuring Diffie–Hellman key exchange, a key derivation function (KDF), symmetric encryption (AES-CBC), message authentication (HMAC-SHA256), forward secrecy, integrity and replay protection, and a simple simulation of a man-in-the-middle (MITM) attacker. This channel provides confidentiality, integrity, and mutual authentication.\n- Note: In a real-world deployment, the initial key exchange would be protected by certificates (e.g., X.509/TLS) or another form of authenticated channel to prevent a man-in-the-middle from tampering with these long-term public keys.\n\n## My Communication Protocol:\n\n1. **Initial Handshake (Asymmetric Key Exchange)**\n   Upon connecting, the client and server each possess a long-term ECC keypair (P-256 curve). The client initiates the handshake by sending its public key (Base64‑encoded DER) to the server. The server responds with its own public key in the same format.\n   - This exchange establishes mutual authentication of the long-term keys.\n   - Both sides then compute a shared secret via Elliptic‑Curve Diffie–Hellman (ECDH).\n\n2. **Key Derivation Function (KDF)**\n   The raw ECDH secret is passed into a KDF based on SHAKE128 XOF, which \"squeezes\" exactly 32 bytes of pseudorandom output.\n   - **Purpose**: normalize the secret to a fixed length, ensure high entropy distribution, and prepare it for symmetric-key usage.\n\n3. **Symmetric Key Splitting**\n   From the 32‑byte KDF output, we derive two distinct symmetric keys by hashing with different labels:\n   - **enc\\_key** is used to encrypt message payloads under AES‑CBC with random IV.\n   = **auth\\_key** is used to generate and verify HMAC-SHA256 over the JSON body.\n\n  \u003cimg width=\"869\" height=\"280\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d60f88b1-2f0e-4fa8-aa18-cef669e865b7\" /\u003e\n\n4. **Per-Message Ratchet**\n   For each message cycle, both client and server generate fresh ephemeral ECC keypairs and include the new public key in the next message or acknowledgment.\n   - After sending, each side updates its private key to the new ephemeral one, discarding the old.\n   - They recompute a fresh shared secret and symmetric keys, achieving forward secrecy: past keys cannot decrypt future messages.\n\n5. **Message Format and Transmission**\n   Each message is encapsulated as a JSON object.\n\u003cimg width=\"869\" height=\"100\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9df6821c-2f1c-4770-abb5-3571c034b125\" /\u003e\n\n\n #### Sample Execution\n   \n```json{\n  \"body\": {\n    \"nonce\": 1,\n    \"warnings\": [],\n    \"text\": \"5a8717dc4718ff1e40b244d8eec69047\",\n    \"iv\": \"e14ee2ea6d57f701f82acb3c85e98fd9\",\n    \"new_pub_key\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEkqarK+XcgKKbSTVi+ajdjB8lFp3SlsvFGwTl8qFc7w1NuYLyuKDUnr9QncQl0Q2kZYfBa4nVQckfcFCOQ/3uog==\"\n  },\n  \"hmac\": \"b4bc93bf989554b30239529c08464420e20fb7ec2a05be9c7c6adb5086574a1d\"\n}\n```\n\n   - **nonce** prevents replay: each side rejects messages with an older counter. \n   - **warnings** accumulates codes for any detected integrity or availability issues.\n   - **text** and **iv** represent the encrypted plaintext and IV.\n   - **new\\_pub\\_key** seeds the next ratchet step.\n\n7. **Message Processing**\n\n   * **Sender**: pads and encrypts the UTF-8 plaintext under AES-CBC, encodes IV and ciphertext in hex, builds the JSON body, computes HMAC over the body, and serializes the full payload.\n   * **Receiver**: parses JSON, validates structure, verifies HMAC (throws `InvalidHashError` on mismatch), checks nonce order (`InvalidNonceError` on replay), decrypts ciphertext (`ValueError` if padding/IV wrong), logs content and warnings, then updates ratchet state.\n\n8. **Attack Simulation (MITM)**\n   A separate `mitm_wrapper.py` acts as a proxy between client and server, allowing configurable behaviors per message index:\n\n   * **Drop**: return empty payload to simulate availability attack.\n   * **Modify**: tamper with JSON fields or ciphertext to test integrity checks.\n   * **Replay**: resend old messages to test nonce-based replay protection.\n\n## Running the Project\n\n- **Install dependencies** - `pip install -r requirements.txt`\n- **(Optional)Generate fresh keys** - Run `entrypoints/generate_keys.py`, copy the printed base64 values into `config/keys.py`.\n- **Start the server** - run `entrypoints/server_wrapper.py`, Ensure the server listens on its configured PORT (default 65432).\n- **(Optional) Start the MITM** - run `entrypoints/mitm_wrapper.py`, Listen on the client port (65431) and forward to the server port (65432).\n- **Start the client** - run `entrypoints/client_wrapper.py` (default 65432, set to 65431 if you want to invite the \"man in the middle\".\n- **Observe logs** - Server logs decrypted messages to `server_output.txt` and Console warnings appear on integrity or drop attacks.\n\nEnjoy experimenting with secure messaging, ratchets, and MITM resilience! :)\n\n## Feedback \u0026 Contact\nIf you find any issues, have questions, or suggestions for improvement, feel free to reach out:\n- Email: yonzra12@gmail.com\n- Linkdin: www.linkedin.com/in/yehonatanezra\n---\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyehoanatnezra%2Fcipherchannel","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fyehoanatnezra%2Fcipherchannel","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyehoanatnezra%2Fcipherchannel/lists"}