# README for edited Vanetza, socktap and certify applications

### Description
These edits were made as a part of master thesis on BUT FEEC university by David Kolaja.
It should be deployed on the side of IRS as a master aplication for the process of remote vehicle stop.

### Edits
* Certify generates certificates with EncryptionKey inside them,
* Certify also shows bytes of keys (public and private) when a user generates them,
* Socktap can now cipher and decipher sent messages using AES128-CCM and ECIES.

### Dependencies
Dependencies are the same as with orignal Vanetza library, but I'll reiterate:
- libssl-dev library (OpenSSL) **(tested 1.1.1f)**
- CMake 3.12 or higher **(tested 3.16.3)**
      - with ninja-build **(tested 1.10.0)**
- Boost 1.58 or higher **(tested on 1.71)**
- GeographicLib 1.37 or higher **(included in /libraries folder)**
- Crypto++ 5.6.1 or higher **(included in /libraries folder)**
- nlohmann-json (optional)

To install any of the libraries included in this repository, unpack it (with tar -xvf or unzip) and make/make install it.

## Build vanetza
After dependencies above are met, you can build and install Vanetza library by running these commands:

Build the library:
```bash
PATH_TO_PROJECT="/home/vut-diplomka/CLionProjects/VUT-vanetza" # an example
cmake -DCMAKE_BUILD_TYPE=Debug -DBUILD_CERTIFY=ON -DBUILD_SOCKTAP=ON -DBUILD_BENCHMARK=OFF -G Ninja -S <PATH_TO_PROJECT> -B <PATH_TO_PROJECT>/cmake-build-debug
```
Install the library:
```bash
sudo cmake --build <PATH_TO_PROJECT>/cmake-build-debug --target install -j 3
```

## Build socktap/certify
After you have installed Vanetza library to your system, you can build applications from Vanetza tool set.

Build command (specify target as either certify, socktap or benchmark):
```bash
cmake --build <PATH_TO_PROJECT>/cmake-build-debug --target socktap -j 3
```

## Run socktap or certify
After installing and building applications, in "<PATH_TO_PROJECT>/cmake-build-debug/bin" folder, there's going to be executable files _**socktap**_ or _**certify**_.
Both of applications take some arguments depending what you want to utilize. Certify stays the same apart from one added input argument:
* --encryption-key - Private key file for encryption key insertion to certificate.

Over the original version, socktap has these additional input arguments:
* encryption-recipient-cert - Certificate of recipient of encrypted messages,
* encryption-recipient-key - Your private key to decrypt secured messages (ECIES),
* encrypt-messages (=0) - Specify if transmitted messages should be encrypted or not.

### Run certify examples (make your own PKI)
Generate private key to file for signature and encryption (ECDSA on nistp-256 curve):
```bash
.bin/certify generate-key --output "ownTicket/sign_ticket_enc_key.key"
```

Generate RootCA certificate:
```bash
.bin/certify generate-root --output "rootCa/rootCa.cert" --subject-key "rootCa/rootCa.key" --subject-name "Root Certificate Authority for test" --days 730 --aid 36 139 37
```

Generate Authorization Authority certificate:
```bash
.bin/certify generate-aa --output "aa/aa.cert" --sign-key "rootCa/rootCa.key" --sign-cert "rootCa/rootCa.cert" --subject-key "aa/aa.key" --subject-name "Authorization Authority for test" --days 365 --aid 36 139 37 
```

Generate Authorization Ticket certificate:
```bash
.bin/certify generate-ticket --output "ownTicket/sign_ticket.cert" --sign-key "aa/aa.key" --sign-cert "aa/aa.cert" --subject-key "ownTicket/sign_ticket_sign_key.key" --encryption-key "ownTicket/sign_ticket_enc_key.key" --days 365 
```

### Run socktap examples
If you would like to connect two running instances of socktap so they can communicate with each other, just run the same version of socktap again on the same interface (option _--interface_ or _-i_), but **with different _--mac-address_**.

Unsecured version altogether with sending CAM messages:
```bash
./bin/socktap -i lo -l ethernet --security none -a ca --mac-address 08:00:27:21:ce:9a
```

Secured version with sending **signed** CAM messages (freshly generated certificates):
```bash
./bin/socktap -i lo -l ethernet --security certs -a ca --mac-address 08:00:27:21:db:11
```

Secured version with sending **signed** CAM messages (your own certificates):
```bash
./bin/socktap -i lo -l ethernet --security certs -a ca --mac-address 08:00:27:21:db:11 --certificate "ownTicket/sign_ticket.cert" --certificate-key "ownTicket/sign_ticket_sign_key.key" --certificate-chain "aa/aa.cert"
```

Secured version with sending **signed and encrypted** CAM messages (freshly generated certificates):
```bash
./bin/socktap --help -i lo -l ethernet --security certs --encryption-recipient-cert ownTicket/ticket.cert --encryption-recipient-key ownTicket/ticket_enc_key.key --encrypt-messages true -a ca --mac-address 08:00:27:21:cc:8f
```

Secured version with sending **signed and encrypted** CAM messages (your own certificates):
```bash
./bin/socktap --help -i lo -l ethernet --security certs --encryption-recipient-cert ownTicket/ticket.cert --encryption-recipient-key ownTicket/ticket_enc_key.key --encrypt-messages true -a ca --mac-address 08:00:27:21:db:5c --certificate ownTicket/sign_ticket.cert --certificate-key ownTicket/sign_ticket_sign_key.key --certificate-chain aa/aa.cert
```