I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket.
My assumption is that malware is running in machine which can read any files in machine and also read any port communication. This means i cannot use SSL to secure the communication as I cannot store private key any were in my machine.
For key exchange i am planning to user Diffie–Hellman key exchange. How can java application (listening to a port) can authenticate or be sure that Firefox extension has initiated the key exchange interaction and not some malware?