
	Netcat 1.10 AES encryption patch
     (c) Mixter <mixter@newyorkoffice.com>

With this patch for netcat you will be able to run secure
encrypted netcat sessions. Both server and client must run
this version of netcat with the same password set.
I found AES suitable for this kind of encryption, because
it uses symmetric keys (same key on both sides) and is the
next generation strong encryption standard. And there has not
yet been made a decision about which of the strongest algorithms
available will be the AES algorithm, you can choose between
15 different algorithms with the same programming interface.
With the aes.h encryption functions encode64, decode64 and setkey,
you can code your own client/server that can handle encrypted netcat
sessions, given the same password and algorithm.

The AES candidates themselves are not included, because I'm not sure
if the current US crypto laws prohibit this - they can be found at:

http://www.attrition.org/~wrlwnd/
http://www.task.gda.pl/pub/security/crypto/LIBS/aes/

This distribution contains:

aes.h - some simple functions that can be used with an
        AES candidate for strong encryption of buffers
base64.h - needed by aes.h for ascii/base64 encoding/armoring
netcat-patch.diff - the patch

Installation:

* Download netcat (locations at the end of this text) and decompress it
* Copy AES includes and patch into the netcat dir
* Apply the diff patchfile with 'patch < netcat-patch.diff' in the netcat dir
* Download an AES algorithm candidate implementation and put the
  .c-file into the netcat dir
* eventually you'll have to remove the line: #include "../std_defs.h"
  in the source of your algorithm
* change the #include "candidate.c" in the netcat.c source to
  include the algorithm you just downloaded, and type 'make' - done

Usage:

Secure netcat behaves just like the normal netcat. When you want to
encrypt a session, type nc -k <password> <options> <host> <ip>
To start a listening server, simply nc -k password -l -p port
Lets say, Saddam wants to tell John something and they both know
that the password is 'iraq'.
John does a 'nc -k iraq -l 123', and Saddam would do a
'echo i want to kill the president|nc -k iraq johns.host.com 123'.

Caveats:

- Secure netcat can also be used with -e argument (program execution
after connection), however, it does this by execve() and it would be
quite complicated to do transparent de-/encryption. Therefore, you should
only execute programs with -k -e that handle the encryption. To code such
programs, include base64.h, aes.h and your algorithm, setkey() a password
and then simply encode64() everything sent to stdout, and decode64()
everything received from stdin.
- The current public aes algorithms are distributed for evaluation
purposes only. Endian conversions (on big endian architectures) should
generally work, but are not guaranteed to.

Netcat can be found at these great places:
http://packetstorm.securify.com/UNIX/netcat
ftp://ftp.technotronic.com
avian.org:/src/hacks/nc110.tgz
zippy.telcom.arizona.edu:/pub/mirrors/avian.org/hacks/nc110.tgz
ftp.sterling.com:/mirrors/avian.org/src/hacks/nc110.tgz
coast.cs.purdue.edu:/pub/tools/unix/netcat/nc110.tgz
ftp.rge.com:/pub/security/coast/mirrors/avian.org/netcat/nc110.tgz

Have fun,

Mixter <mixter@newyorkoffice.com>
http://members.tripod.com/mixtersecurity
