Domain
I am designing a piece of software ATM and I would like to hide necessary cryptographic operations behind a "crypto daemon", which accesses encrypted keys on disk and offers a high level, application specific interface to these operations.
The other programs have to:
- Authenticate to the daemon (valid authentication allows the daemon to decrypt the keys on disk)
- Issue commands to the daemon and receive answers
I have the idea of using TCP via localhost for these operations. After doing the TCP handshake, the program has to authenticate to the daemon and - if successful - crypto commands can be issued to the daemon.
Actual Question
At least two assumptions have to hold, otherwise this is insecure by design:
- TCP channels on localhost cannot be hijacked/modified (except by the admin/root)
- TCP channels on localhost are private (cannot be peeked at) (except by admin/root)
Are these assumptions true? Why? Why not? Is anything else flawed?