Skip to content

Migration to mTLS and Asymmetric Cryptographic Authentication

Choose a tag to compare

View all tags
@itsVentie itsVentie released this 10 Jul 15:10
v1.1.0
00dc4c1
This commit was signed with the committer’s verified signature.
itsVentie Ventie
GPG key ID: 2ED2D49AD31F7450
Verified
Learn about vigilant mode.

What's New in v1.1.0

In this major update, we have completely overhauled the project's transport security architecture. We shifted away from symmetric pre-shared secret verification (-secret) to full mutual node authentication via TLS (mTLS). This guarantees strict infrastructure isolation and ensures that clients are fully authorized before any resource-intensive post-quantum cryptographic (PQC) handshakes are initiated.

Key Changes & Resolved Issues

  • Migration to Transport mTLS: The initialization signatures for network.NewServer and network.NewClient have been fully refactored to work with comprehensive *tls.Config cryptographic contexts. The legacy string-based validation mechanism has been completely removed.
  • Asynchronous Handshake (Deadlock Elimination): The tlsConn.Handshake() call on the server side has been moved into the concurrent context of the handleConnection goroutine. This unblocked the main Accept loop thread, successfully eliminating deadlocks during simultaneous connections and preventing premature connection teardowns (wsarecv: An existing connection was forcibly closed by the remote host).
  • PKI Context Isolation in Tests: The testing suite in integration_test.go now features a genuine local Public Key Infrastructure (local CA) setup. It enforces strict separation of serial numbers and individual certificates for both the client and server, removing low-level network loopback buffer collisions (tls: error decoding message).
  • Cross-Compilation Automation: The test.ps1 automation script has been updated. The build pipeline now automatically builds, cross-compiles, and isolates optimized production binaries for both Windows (amd64) and Linux (amd64) inside a dedicated ./dist directory.

Performance Validation Results

Despite the introduction of an asymmetric mTLS transport layer, the core proxy engine maintains its peak efficiency due to optimized memory pooling. High-load execution metrics on an Intel(R) Core(TM) i5-14600KF CPU show an increased frame processing rate while maintaining a strict zero-pressure profile on the Go garbage collector:

BenchmarkProxyPipe-20 1039668 1069 ns/op 0 B/op 0 allocs/op

Using the Updated Build

The -secret flag has been deprecated. Deploying the tunnel now requires passing pre-configured TLS certificate parameters (either programmatically or via an updated configuration layer):

  • Run Server: ./pqc-proxy -mode server -listen :9090 -target 127.0.0.1:8000
  • Run Client: ./pqc-proxy -mode client -listen :3000 -target 127.0.0.1:9090

To locally verify the entire pipeline, run integration tests, and execute the cross-compilation suite:
.\test.ps1

Assets 4
Loading