search

danwent / Perspectives-Server

network notary implementation for the Perspectives project
http://perspectives-project.org
GNU General Public License v3.0
50 stars 13 forks source link

Include the host name inside signed replies #24

Open daveschaefer opened 11 years ago

daveschaefer commented 11 years ago

Currently the notary reply does not contain the host name. We should include it so clients can verify that the fingerprint returned is indeed for the host they expected.

Using SSL to encrypt the reply would also protect against attacks, but we should include it in the reply just in case.

danwent commented 11 years ago

Dave, the signature on the reply include the service_id, which includes the hostname + port, so there is no risk of the reply being for a different host and still being accepted by the client.

See: https://github.com/danwent/Perspectives-Server/blob/master/client/client_common.py#L67