I'm unable to get any sort of meaningful encryptiong working with UFTP. I'm running the server with a private key that uftp generated:
uftp -Y aes256-gcm -h sha256 -k uftp_priv.pem -R 40000 file.txt
One client like this:
uftpd -d -E -k private_key.pem -D /.firmware
And the other like this:
uftpd -d -E -D /.firmware
I haven't registered the clients' public keys with the server, nor vice versa, but both receivers still get the file.
I would expect:
(A) without the server having the clients' public keys, and the clients having the server's public key, encryption and decryption wouldn't be possible
(B) The second client does not specify a key, but does specify -E, which should only allow for encypted transfers. I wouldn't expect this to work at all.
How can I ensure encyrption is working and that anything on the network running uftpd can't receive the files just by sitting there listening?
Here's the server log:
$ uftp -Y aes256-gcm -h sha256 -k uftp_priv.pem -R 40000 file.txt
UFTP version 5.0.3 Copyright (C) 2001-2023 Dennis A. Bush
Starting at Tue Sep 16 22:42:30 2025
Loaded 2048 bit RSA key with fingerprint 9D:4B:2A:06:05:6D:F8:05:DF:54:42:23:F9:2D:50:25:22:BB:0B:88
Loaded ECDH key with curve prime256v1
Transfer rate: 40000 Kbps (5000 KB/s)
Wait between packets: 269531 ns
Using private multicast address 230.5.5.114 Group ID: 41A78528
Initializing group
Sending ANNOUNCE 1
Received REGISTER from client 0x0A7E0C3E
Received REGISTER from client 0x0A7E0C37
Sending KEYINFO 2.1
Sending ANNOUNCE 2
Received KEYINFO_ACK from 0x0A7E0C3E
Received KEYINFO_ACK from 0x0A7E0C37
Sending ANNOUNCE 3
Sending ANNOUNCE 4
Sending ANNOUNCE 5
Sending ANNOUNCE 6
Sending ANNOUNCE 7
Sending ANNOUNCE 8
Sending ANNOUNCE 9
Sending ANNOUNCE 10
Sending ANNOUNCE 11
Sending ANNOUNCE 12
Sending ANNOUNCE 13
Sending ANNOUNCE 14
Sending ANNOUNCE 15
Sending ANNOUNCE 16
Sending ANNOUNCE 17
Sending ANNOUNCE 18
Sending ANNOUNCE 19
Sending ANNOUNCE 20
----- file.txt -----
File ID: 0001 Name: file.txt
sending as: file.txt
Bytes: 2548 Blocks: 2 Sections: 1
Sending FILEINFO 1.1
Received FILEINFO_ACK from client 0x0A7E0C3E
Received FILEINFO_ACK from client 0x0A7E0C37
Sending file
Starting pass 1
Sending section 0
Sending DONE 1.1
Got COMPLETE from client 0x0A7E0C37
Got COMPLETE from client 0x0A7E0C3E
Transfer status:
Host: 0x0A7E0C3E Status: Completed time: 0.004 seconds
Host: 0x0A7E0C37 Status: Completed time: 0.004 seconds
Total elapsed time: 0.004 seconds
Overall throughput: 581.51 KB/s
Finishing group
Sending DONE 1.1
Got COMPLETE from client 0x0A7E0C37
Got COMPLETE from client 0x0A7E0C3E
Late completions:
Sending DONE_CONF 2.1
Group complete
uftp: Finishing at Tue Sep 16 22:42:32 2025
Here's the first receiver:
$ uftpd -d -E -k uftp_priv.pem -D /.firmware/
2025/09/17 04:42:25.079444: UFTP version 5.0.3 Copyright (C) 2001-2023 Dennis A. Bush
2025/09/17 04:42:25.079845: Loaded 2048 bit RSA key with fingerprint 1C:EB:97:89:81:0F:FF:C1:4F:9F:02:5B:39:9A:31:32:1F:7C:B4:B4
2025/09/17 04:42:27.882259: [41A78528/00:0]: Received request from 0A7E0C35 at 10.126.12.53 (10.126.12.53)
2025/09/17 04:42:27.882289: [41A78528/00:0]: Using private multicast address 230.5.5.114
2025/09/17 04:42:27.882810: [41A78528/00:0]: REGISTER sent
2025/09/17 04:42:29.357994: [41A78528/00:0]: Received KEYINFO
2025/09/17 04:42:29.358363: [41A78528/00:0]: KEYINFO_ACK sent
2025/09/17 04:42:30.273221: [41A78528/00:0001]: Name of file to receive: file.txt
2025/09/17 04:42:30.273315: [41A78528/00:0001]: Bytes: 2548, Blocks: 2, Sections: 1
2025/09/17 04:42:30.273431: [41A78528/00:0001]: FILEINFO_ACK sent
2025/09/17 04:42:30.276639: [41A78528/00:0001]: Got DONE message for section 0
2025/09/17 04:42:30.277438: [41A78528/00:0001]: File transfer complete
2025/09/17 04:42:30.277586: [41A78528/00:0001]: COMPLETE sent
2025/09/17 04:42:30.277605: [41A78528/00:0001]: starting file close
2025/09/17 04:42:30.277619: [41A78528/00:0001]: done file close
2025/09/17 04:42:30.280022: [41A78528/00:0]: Got DONE message for group
2025/09/17 04:42:30.280043: [41A78528/00:0]: Group complete
2025/09/17 04:42:30.280073: [41A78528/00:0]: COMPLETE sent
2025/09/17 04:42:30.283416: [41A78528/00:0]: Group file transfer confirmed
And the second receiver:
$ uftpd -d -E -D /.firmware
2025/09/17 04:44:08.214004: UFTP version 5.0.3 Copyright (C) 2001-2023 Dennis A. Bush
2025/09/17 04:44:08.214416: Loaded ECDSA key with curve prime256v1 and fingerprint 9B:FE:88:74:08:6F:93:27:55:23:75:37:25:C4:03:F8:C1:03:8B:24
2025/09/17 04:44:17.425822: [41A78528/00:0]: Received request from 0A7E0C35 at 10.126.12.53 (10.126.12.53)
2025/09/17 04:44:17.425854: [41A78528/00:0]: Using private multicast address 230.5.5.114
2025/09/17 04:44:17.426905: [41A78528/00:0]: REGISTER sent
2025/09/17 04:44:18.901561: [41A78528/00:0]: Received KEYINFO
2025/09/17 04:44:18.901846: [41A78528/00:0]: KEYINFO_ACK sent
2025/09/17 04:44:19.816793: [41A78528/00:0001]: Name of file to receive: file.txt
2025/09/17 04:44:19.816825: [41A78528/00:0001]: Bytes: 2548, Blocks: 2, Sections: 1
2025/09/17 04:44:19.816936: [41A78528/00:0001]: FILEINFO_ACK sent
2025/09/17 04:44:19.820198: [41A78528/00:0001]: Got DONE message for section 0
2025/09/17 04:44:19.820953: [41A78528/00:0001]: File transfer complete
2025/09/17 04:44:19.821082: [41A78528/00:0001]: COMPLETE sent
2025/09/17 04:44:19.821215: [41A78528/00:0001]: starting file close
2025/09/17 04:44:19.821303: [41A78528/00:0001]: done file close
2025/09/17 04:44:19.823588: [41A78528/00:0]: Got DONE message for group
2025/09/17 04:44:19.823657: [41A78528/00:0]: Group complete
2025/09/17 04:44:19.823803: [41A78528/00:0]: COMPLETE sent
2025/09/17 04:44:19.826975: [41A78528/00:0]: Group file transfer confirmed
^C2025/09/17 04:45:08.367782: Exiting on signal 2
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Encryption is in fact working. There's just no verification of the remote machines' keys happening.
The initial ANNOUNCE message from the server includes the server's public signing key, and the CLIENT_KEY response from the client (which requires the -c option on the server) contains the client's public signing key.
The -H option on the server can specify the expected key fingerprint for each client, and similarly the -S option on the client can specify the expected key fingerprint for each server. Adding these options is what validates public keys.
Regards,
Dennis
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I'm unable to get any sort of meaningful encryptiong working with UFTP. I'm running the server with a private key that uftp generated:
uftp -Y aes256-gcm -h sha256 -k uftp_priv.pem -R 40000 file.txt
One client like this:
uftpd -d -E -k private_key.pem -D /.firmware
And the other like this:
uftpd -d -E -D /.firmware
I haven't registered the clients' public keys with the server, nor vice versa, but both receivers still get the file.
I would expect:
(A) without the server having the clients' public keys, and the clients having the server's public key, encryption and decryption wouldn't be possible
(B) The second client does not specify a key, but does specify -E, which should only allow for encypted transfers. I wouldn't expect this to work at all.
How can I ensure encyrption is working and that anything on the network running uftpd can't receive the files just by sitting there listening?
Here's the server log:
$ uftp -Y aes256-gcm -h sha256 -k uftp_priv.pem -R 40000 file.txt
UFTP version 5.0.3 Copyright (C) 2001-2023 Dennis A. Bush
Starting at Tue Sep 16 22:42:30 2025
Loaded 2048 bit RSA key with fingerprint 9D:4B:2A:06:05:6D:F8:05:DF:54:42:23:F9:2D:50:25:22:BB:0B:88
Loaded ECDH key with curve prime256v1
Transfer rate: 40000 Kbps (5000 KB/s)
Wait between packets: 269531 ns
Using private multicast address 230.5.5.114 Group ID: 41A78528
Initializing group
Sending ANNOUNCE 1
Received REGISTER from client 0x0A7E0C3E
Received REGISTER from client 0x0A7E0C37
Sending KEYINFO 2.1
Sending ANNOUNCE 2
Received KEYINFO_ACK from 0x0A7E0C3E
Received KEYINFO_ACK from 0x0A7E0C37
Sending ANNOUNCE 3
Sending ANNOUNCE 4
Sending ANNOUNCE 5
Sending ANNOUNCE 6
Sending ANNOUNCE 7
Sending ANNOUNCE 8
Sending ANNOUNCE 9
Sending ANNOUNCE 10
Sending ANNOUNCE 11
Sending ANNOUNCE 12
Sending ANNOUNCE 13
Sending ANNOUNCE 14
Sending ANNOUNCE 15
Sending ANNOUNCE 16
Sending ANNOUNCE 17
Sending ANNOUNCE 18
Sending ANNOUNCE 19
Sending ANNOUNCE 20
----- file.txt -----
File ID: 0001 Name: file.txt
sending as: file.txt
Bytes: 2548 Blocks: 2 Sections: 1
Sending FILEINFO 1.1
Received FILEINFO_ACK from client 0x0A7E0C3E
Received FILEINFO_ACK from client 0x0A7E0C37
Sending file
Starting pass 1
Sending section 0
Sending DONE 1.1
Got COMPLETE from client 0x0A7E0C37
Got COMPLETE from client 0x0A7E0C3E
Transfer status:
Host: 0x0A7E0C3E Status: Completed time: 0.004 seconds
Host: 0x0A7E0C37 Status: Completed time: 0.004 seconds
Total elapsed time: 0.004 seconds
Overall throughput: 581.51 KB/s
Finishing group
Sending DONE 1.1
Got COMPLETE from client 0x0A7E0C37
Got COMPLETE from client 0x0A7E0C3E
Late completions:
Sending DONE_CONF 2.1
Group complete
uftp: Finishing at Tue Sep 16 22:42:32 2025
Here's the first receiver:
$ uftpd -d -E -k uftp_priv.pem -D /.firmware/
2025/09/17 04:42:25.079444: UFTP version 5.0.3 Copyright (C) 2001-2023 Dennis A. Bush
2025/09/17 04:42:25.079845: Loaded 2048 bit RSA key with fingerprint 1C:EB:97:89:81:0F:FF:C1:4F:9F:02:5B:39:9A:31:32:1F:7C:B4:B4
2025/09/17 04:42:27.882259: [41A78528/00:0]: Received request from 0A7E0C35 at 10.126.12.53 (10.126.12.53)
2025/09/17 04:42:27.882289: [41A78528/00:0]: Using private multicast address 230.5.5.114
2025/09/17 04:42:27.882810: [41A78528/00:0]: REGISTER sent
2025/09/17 04:42:29.357994: [41A78528/00:0]: Received KEYINFO
2025/09/17 04:42:29.358363: [41A78528/00:0]: KEYINFO_ACK sent
2025/09/17 04:42:30.273221: [41A78528/00:0001]: Name of file to receive: file.txt
2025/09/17 04:42:30.273315: [41A78528/00:0001]: Bytes: 2548, Blocks: 2, Sections: 1
2025/09/17 04:42:30.273431: [41A78528/00:0001]: FILEINFO_ACK sent
2025/09/17 04:42:30.276639: [41A78528/00:0001]: Got DONE message for section 0
2025/09/17 04:42:30.277438: [41A78528/00:0001]: File transfer complete
2025/09/17 04:42:30.277586: [41A78528/00:0001]: COMPLETE sent
2025/09/17 04:42:30.277605: [41A78528/00:0001]: starting file close
2025/09/17 04:42:30.277619: [41A78528/00:0001]: done file close
2025/09/17 04:42:30.280022: [41A78528/00:0]: Got DONE message for group
2025/09/17 04:42:30.280043: [41A78528/00:0]: Group complete
2025/09/17 04:42:30.280073: [41A78528/00:0]: COMPLETE sent
2025/09/17 04:42:30.283416: [41A78528/00:0]: Group file transfer confirmed
And the second receiver:
$ uftpd -d -E -D /.firmware
2025/09/17 04:44:08.214004: UFTP version 5.0.3 Copyright (C) 2001-2023 Dennis A. Bush
2025/09/17 04:44:08.214416: Loaded ECDSA key with curve prime256v1 and fingerprint 9B:FE:88:74:08:6F:93:27:55:23:75:37:25:C4:03:F8:C1:03:8B:24
2025/09/17 04:44:17.425822: [41A78528/00:0]: Received request from 0A7E0C35 at 10.126.12.53 (10.126.12.53)
2025/09/17 04:44:17.425854: [41A78528/00:0]: Using private multicast address 230.5.5.114
2025/09/17 04:44:17.426905: [41A78528/00:0]: REGISTER sent
2025/09/17 04:44:18.901561: [41A78528/00:0]: Received KEYINFO
2025/09/17 04:44:18.901846: [41A78528/00:0]: KEYINFO_ACK sent
2025/09/17 04:44:19.816793: [41A78528/00:0001]: Name of file to receive: file.txt
2025/09/17 04:44:19.816825: [41A78528/00:0001]: Bytes: 2548, Blocks: 2, Sections: 1
2025/09/17 04:44:19.816936: [41A78528/00:0001]: FILEINFO_ACK sent
2025/09/17 04:44:19.820198: [41A78528/00:0001]: Got DONE message for section 0
2025/09/17 04:44:19.820953: [41A78528/00:0001]: File transfer complete
2025/09/17 04:44:19.821082: [41A78528/00:0001]: COMPLETE sent
2025/09/17 04:44:19.821215: [41A78528/00:0001]: starting file close
2025/09/17 04:44:19.821303: [41A78528/00:0001]: done file close
2025/09/17 04:44:19.823588: [41A78528/00:0]: Got DONE message for group
2025/09/17 04:44:19.823657: [41A78528/00:0]: Group complete
2025/09/17 04:44:19.823803: [41A78528/00:0]: COMPLETE sent
2025/09/17 04:44:19.826975: [41A78528/00:0]: Group file transfer confirmed
^C2025/09/17 04:45:08.367782: Exiting on signal 2
Sean,
Encryption is in fact working. There's just no verification of the remote machines' keys happening.
The initial ANNOUNCE message from the server includes the server's public signing key, and the CLIENT_KEY response from the client (which requires the -c option on the server) contains the client's public signing key.
The -H option on the server can specify the expected key fingerprint for each client, and similarly the -S option on the client can specify the expected key fingerprint for each server. Adding these options is what validates public keys.
Regards,
Dennis
Thanks @dennisbush, you're totally right. I didn't include the -c option and I was expecting that behavior.