Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket.

My assumption is that malware is running in machine which can read any files in machine and also read any port communication. This means i cannot use SSL to secure the communication as I cannot store private key any were in my machine.

For key exchange i am planning to user Diffie–Hellman key exchange. How can java application (listening to a port) can authenticate or be sure that Firefox extension has initiated the key exchange interaction and not some malware?

share|improve this question
1  
Short answer: It's impossible. If your application is running on the same machine with a sufficiently privileged malware, you're doomed. –  CodesInChaos Nov 15 '13 at 12:33
    
i assume malware can only read files, and also send some thing to port. Still doomed?? –  amit Nov 15 '13 at 12:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.