Python implementation of sshnpd v5 features

[gkc]

Is your feature request related to a problem? Please describe.

Python sshnpd is at v4 feature set and ideally would be at v5 feature set

Describe the solution you'd like

Support v5 features - authentication to the rvd, and end-to-end encryption of the traffic via the rvd

Additional context

The C implementation is the engineering priority; enhancing the Python daemon is a nice-to-have (unless we run into showstoppers with the C implementation)

The key differences between v4 and v5 for the daemon are

• Request from client contains additional parameters
  • authenticateToRvd: boolean. if true, the daemon has to send an authentication message when it first connects to the rvd
  • clientNonce: String: required for generation of the authentication message
  • rvdNonce: String: required for generation of the authentication message
  • encryptRvdTraffic: boolean: if true, the daemon will have to
  • generate an ephemeral AES256 key and IV, encrypt them using the clientEphemeralPK, base64-encode them, and send them in the response to the client
  • encrypt the stream of traffic to the rvd using that AES key
  • decrypt the stream of traffic from the rvd using that AES key
  • clientEphemeralPK: base64-encoded String: an ephemeral public key generated by the client for this session
  • clientEphemeralPKType: the type of public key (only rsa2048 right now)

[cpswan]

We probably want to leave this until after we have the C implementation, and even then it's nice to have.

[gkc]

We probably want to leave this until after we have the C implementation, and even then it's nice to have.

Yep as mentioned in "Additional Context" above