network plugin: Implement signing and encryption of network traffic.
The patch adds shared secret signing and encryption of network traffic.
Currently, there are three “security levels”:
- Encrypt
Encrypt outgoing data and only accept encrypted data when receiving.
- Sign
Outgoing data is signed; signed and encrypted data is accepted when
receiving.
- None
Send without any cryptography and accept anything when receiving.
The security level and shared secret can be set per-socket, so that
forwarding instances can re-encrypt and similar goodies.
The libgcrypt library is used to calculate hashes, encrypt and decrypt,
see <http://www.gnu.org/software/libgcrypt/>. I tested compiling the
`network' plugin without libgcrypt afterwards, but haven't tested this
much yet.
Algorithms used are SHA-256 for signing and AES-256 in ECB mode /
SHA-224 when encrypting. Also, SHA-256 is used to get the 32 byte key
for AES-256 from the user-supplied secret.