I want to be able to change the key and iv on a connection that is already established. Currently I just have a simple socket BIO and cipher BIO chained together. (Cipher is EVP_bf_cbc() currently.)
The connection should look like this:
1) client connects to server
2) set both client and server to use key/iv "foo/bar"
3) send some data
4) set both client and server to use new key/iv "one/two"
5) send more data
#1 through #3 are working fine, I can easily verify that the data sent
is what I recieve. It's #4 and #5 that seem to be failing.
Doing doing operation #4 above is clearly what I need to fix.
I've tried:
* calling BIO_set_cipher on the cipher BIO directly.
* removing the cipher BIO and adding a new one with the
correct key/iv to the socket BIO.
* calling BIO_flush on the chain before using any of the
previous two changes, discarding any padding bytes from
the BIO_flush.
I'm doing the same thing on both ends, of course - it would never
work to change the key on client and not server and expect things
to work. This is unidirectional data flow -- the server never sends
any data to the client.
Any quick ideas where my brain or code is failing me?
--
Brian Hatch LLooccall EEcchhoo iiss
Systems and uunnddeerrrraatteedd.
Security Engineer
http://www.ifokr.org/bri/
Every message PGP signed
pgp00000.pgp
Description: PGP signature
