https://github.com/redteampentesting/kbtls
Establishes mutually trusted TLS connections based on a pre-shared connection key.
https://github.com/redteampentesting/kbtls
Last synced: about 1 year ago
JSON representation
Establishes mutually trusted TLS connections based on a pre-shared connection key.
- Host: GitHub
- URL: https://github.com/redteampentesting/kbtls
- Owner: RedTeamPentesting
- License: mit
- Created: 2023-03-22T12:52:36.000Z (about 3 years ago)
- Default Branch: main
- Last Pushed: 2024-03-21T10:26:33.000Z (over 2 years ago)
- Last Synced: 2025-03-31T00:06:13.216Z (about 1 year ago)
- Language: Go
- Homepage:
- Size: 438 KB
- Stars: 48
- Watchers: 1
- Forks: 4
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
kbtls
Key-Based TLS - Mutually Trusted TLS Connections Based on a Pre-Shared Connection Key
---
This library allows to create mutually trusted client and server certificates
based on a pre-shared connection key. This is possible because the pre-shared
connection key can be used on both sides to derive the same CA certificate which
is then used to sign the server and client certificates that are generated on
the spot.
---
**Warning:** This library is not meant for production use. It was developed to
be used in offensive security tools to conveniently provide an encrypted
connection ad-hoc without certificate management. While we are unaware of any
security risks with the library's approach, it uses TLS in an unconventional way
which may introduce subtle vulnerabilities. Please contact us if you are aware
of any security considerations regarding this library.
---
## Usage:
The following example shows how a connection key can be generated in order to
generate a listener:
```go
key, err := kbtls.GenerateConnectionKey()
// error handling
fmt.Println(key) // tvyFtKR0Y2IY/sN5EbxYscr15fGxa8Mx2NeelZUCpn0
listener, err := kbtls.Listen("tcp", "localhost:8443", key.String())
// error handling
```
In most cases, one endpoint generates and outputs the key like this. The user
then passes the generated key to the other endpoint where it can be used as
follows:
```go
key := "tvyFtKR0Y2IY/sN5EbxYscr15fGxa8Mx2NeelZUCpn0"
conn, err := kbtls.Dial("tcp", "localhost:8443", key)
// error handling
```
A full server and client example can be found
[here](https://github.com/RedTeamPentesting/kbtls/blob/main/examples/simple/main.go).
For custom listeners or for custom TLS configuration lower-level functions are
provided, as demonstrated
[here](https://github.com/RedTeamPentesting/kbtls/blob/main/examples/custom/main.go).