Encryption

​

Encryption Overview

​

How It Works

​

Key-Based Authentication

Passkey: 32-character hexadecimal string
Example: a7f3e9d2c8b4f1e0a3c7b9d5f2e8c1a4

• 128-bit security (256 hex characters = 128 bits)
• Symmetric: Same key used by client and terminal
• Generated randomly when terminal starts
• No key exchange protocol (pre-shared key model)

​

Encryption Flow

​

What Gets Encrypted

• All terminal input (keystrokes, commands)
• All terminal output (command results, shell prompts)
• Control sequences (ANSI codes, cursor movements)

• Connection metadata (IP addresses, port numbers)
• Client ID (sent in plaintext to identify session)
• Server-to-terminal routing (local named pipe, same machine)

​

XSalsa20 Cipher

​

Why XSalsa20?

• Fast: ~2-3 GB/s throughput (software-only)
• Simple: Stream cipher, no complex key schedules
• Proven: Salsa20 family designed by Daniel J. Bernstein
• Extended nonce: 192-bit nonce prevents collisions

​

Implementation Details

• 192-bit random nonce per message
• Nonce sent in plaintext alongside ciphertext
• No nonce reuse (critical for stream ciphers)

[Nonce (24 bytes)][Ciphertext (variable)][MAC (optional)]

• Encryption adds ~0.1-0.2ms latency per message
• Negligible CPU usage (less than 1% on modern processors)
• No buffering delays

​

Configuration

​

Server-Side Configuration

# ut.cfg
require_key = true

• Clients MUST provide a valid passkey
• Unencrypted connections are rejected
• All traffic is encrypted end-to-end

# ut.cfg
require_key = false

• Clients CAN provide passkey (optional)
• Unencrypted connections accepted
• Mixed encrypted/unencrypted sessions on same server

​

Client-Side Usage

./undying-terminal.exe `
  --connect 192.168.1.10 2022 2f3a9c1b `
  --key a7f3e9d2c8b4f1e0a3c7b9d5f2e8c1a4

./undying-terminal.exe `
  --connect 192.168.1.10 2022 2f3a9c1b

​

Terminal-Side Setup

echo "a7f3e9d2c8b4f1e0a3c7b9d5f2e8c1a4" | ./undying-terminal-terminal.exe

echo "XXX" | ./undying-terminal-terminal.exe

​

Security Considerations

​

Threat Model

• Passive attackers on WiFi/LAN cannot read traffic
• ISP/network admins cannot see terminal content
• VPN providers cannot inspect sessions

• Attackers cannot decrypt traffic without passkey
• Attackers cannot inject valid encrypted commands

• Server operator can modify code to log passkeys
• Server machine compromise exposes all traffic (decrypted)

• If passkey is stolen, all past and future traffic is compromised
• No forward secrecy

• Malware on client or server machines can read plaintext
• Keyloggers capture input before encryption

​

Best Practices

• Encryption optional but recommended
• Focus on firewall rules (restrict port 2022 access)

• Encryption MANDATORY
• Verify server IP/hostname before connecting
• Use VPN in addition to encryption for defense in depth

• Enable require_key = true
• Use firewall to limit allowed IPs
• Monitor connection logs for unauthorized attempts
• Consider additional authentication layer (SSH tunnel first)

​

Key Rotation

​

When to Rotate

• Passkey accidentally exposed (committed to git, sent in plaintext)
• Employee with key access leaves organization
• Suspected compromise

• Every 30 days for production systems
• Every 90 days for development systems
• After major security incidents (even if not directly affected)

​

How to Rotate

# OpenSSL (any OS):
openssl rand -hex 16

# Windows (PowerShell):
-join ((1..16) | ForEach-Object { "{0:x2}" -f (Get-Random -Max 256) })

echo "f3c7a9e2d4b8f1c0a7e3b9d5c2f8e1a6" | ./undying-terminal-terminal.exe

./undying-terminal.exe `
  --connect 192.168.1.10 2022 <NEW_CLIENT_ID> `
  --key f3c7a9e2d4b8f1c0a7e3b9d5c2f8e1a6

# In old session:
exit

​

Rotation Automation

# rotate-undying-session.ps1
$NewKey = -join ((1..16) | ForEach-Object { "{0:x2}" -f (Get-Random -Max 256) })

# Start new terminal
$Terminal = Start-Process -FilePath "./undying-terminal-terminal.exe" `
                          -ArgumentList "" `
                          -PassThru `
                          -NoNewWindow

# Parse client ID from terminal output
Start-Sleep -Seconds 2
# (Implementation depends on how you capture terminal output)

# Update client script with new credentials
$ClientScript = @"
./undying-terminal.exe `
  --connect 192.168.1.10 2022 <CLIENT_ID> `
  --key $NewKey
"@

Set-Content -Path "connect.ps1" -Value $ClientScript

Write-Host "New key: $NewKey"
Write-Host "Client script updated: connect.ps1"

​

Encryption Performance

​

Benchmarks

• Typing: No perceptible difference
• Large file operations: ~2-4% slower
• CPU usage: +0.5% average

​

Optimization Tips

# Skip encryption entirely
./undying-terminal.exe --connect 192.168.1.10 2022 2f3a9c1b

• Encryption overhead is negligible for interactive use
• Focus on network latency (use local server when possible)
• Terminal output volume matters more than encryption cost

​

Comparison to Other Tools

• Simpler: No complex key exchange
• Faster: Direct encryption without handshake
• Less secure: No forward secrecy, key theft compromises all sessions

# SSH tunnel to server:
ssh -L 2022:localhost:2022 user@192.168.1.10

# Then connect Undying Terminal locally:
./undying-terminal.exe --connect 127.0.0.1 2022 2f3a9c1b --key <KEY>

• SSH’s forward secrecy
• Undying Terminal’s session persistence
• Double encryption (SSH + XSalsa20)

​

Next Steps

• Learn about Recovery Protocol for data integrity
• Set up Port Forwarding with encryption
• Review Server Configuration security options