ZeroMQ C# Ironhouse example

Question

I am fairly new to ZeroMQ and have been comparing security of messages using the ZeroMQ NuGet package and the NetMQ & NetMQ Security NuGet packages.

So far, I have not been able to find a C# version of the Ironhouse example using Curve Security. There is a "todo" item on the ZGuides repo but so far nothing implemented. (https://github.com/metadings/zguide/issues/1)

I am also trying to determine whether the NetMQ.Security approach to security is better than the curve security approach that is built into ZeroMQ 4. It seems like most information about Curve is at least from 2014 or earlier.

Any information would be greatly appreciated!

Answer 1

Both publisher and subscriber need to use its own set of public\private keys. In your sample code for subscriber you set CurvePublicKey (to that of server, which is wrong but still) but do not set CurveSecretKey - that's why you get "cannot open client INITIATE vouch". Here is your sample from another question fixed:

public class Program
{
    static void Main(string[] args) {
        using (var context = new ZContext()) {
            Console.WriteLine($"Curve Supported: {ZeroMQ.ZContext.Has("curve")}");
            byte[] serverPublicKey;
            byte[] serverSecretKey;
            Z85.CurveKeypair(out serverPublicKey, out serverSecretKey);

            var publisher = new ZSocket(context, ZSocketType.PUB);
            publisher.CurvePublicKey = serverPublicKey;
            publisher.CurveSecretKey = serverSecretKey;
            publisher.CurveServer = true;
            publisher.Bind("tcp://*:5050");

            var subscriber = new ZSocket(context, ZSocketType.SUB);
            byte[] subPublicKey;
            byte[] subSecretKey;
            Z85.CurveKeypair(out subPublicKey, out subSecretKey);
            subscriber.CurvePublicKey = subPublicKey;
            subscriber.CurveSecretKey = subSecretKey;
            subscriber.CurveServerKey = serverPublicKey;
            ZError connectError;
            subscriber.Connect("tcp://mybox:5050", out connectError);
            if (connectError != null) {
                Console.WriteLine($"Connection error: {connectError.Name} - {connectError.Number} - {connectError.Text}");
            }
            subscriber.SubscribeAll();

            // Publish some messages
            Task.Run(() => {
                for (var i = 1; i <= 5; i++) {
                    var msg = $"Pub msg: {Guid.NewGuid().ToString()}";
                    using (var frame = new ZFrame(msg)) {
                        publisher.Send(frame);
                    }
                }
            });
            Task.Run(() => {
                // Receive some messages
                while (true) {
                    using (var frame = subscriber.ReceiveFrame()) {
                        var msg = frame.ReadString();
                        Console.WriteLine($"Received: {msg}");
                    }
                }
            });
            Console.WriteLine("Press ENTER to exit");
            Console.ReadLine();
            ZError subError;
            subscriber.Disconnect("tcp://mybox:5050", out subError);
            subscriber.Dispose();
            ZError pubError;
            publisher.Disconnect("tcp://*:5050", out pubError);
            publisher.Dispose();
        }
    }
}

Answer 2

Indeed, there are not much C# examples with NetMQ. I found this that works "CurveTests.cs":

    public void CurveTest()
    {
        var serverPair = new NetMQCertificate();
        using var server = new DealerSocket();
        server.Options.CurveServer = true;
        server.Options.CurveCertificate = serverPair;
        server.Bind($"tcp://127.0.0.1:55367");
        
        var clientPair = new NetMQCertificate();
        using var client = new DealerSocket();
        client.Options.CurveServerKey = serverPair.PublicKey;
        client.Options.CurveCertificate = clientPair;
        client.Connect("tcp://127.0.0.1:55367");

        for (int i = 0; i < 100; i++)
        {
            client.SendFrame("Hello");
            var hello = server.ReceiveFrameString();
            Assert.Equal("Hello", hello);
            
            server.SendFrame("World");
            var world = client.ReceiveFrameString();
            Assert.Equal("World", world);
        }
    }

Important note - if you want to share server public key between different applications, don't use string representation (serverPair.PublicKeyZ85), because encryption won't work. I assume it related to encoding. Better save byte array representation to some file and share it instead:

File.WriteAllBytes("serverPublicKey.txt", serverPair.PublicKey);