The client would encrypt the ticket (password) with the public key and send the result back to the server, which would decrypt and verify the ticket. The server would generate an RSA public/private keypair and send its public key to the client. The original SPICE protocol defined a ticket based authentication scheme using a shared secret. In addition to encryption, the SPICE protocol allows for a choice of authentication schemes. The TLS mode provides strong encryption of all traffic transmitted on the data channel. A data channel can be designated to operate in either clear-text, or TLS modes, allowing the administrator to tradeoff the security level vs performance. A SPICE client connection to a remote desktop server consists of multiple data channels, each of which is run over a separate TCP or UNIX socket connection.
0 kommentar(er)
