111 reputation
19
bio website
location
age
visits member for 2 years, 2 months
seen Apr 4 '13 at 20:54

Apr
1
awarded  Notable Question
Apr
3
awarded  Popular Question
Dec
18
awarded  Popular Question
Jun
13
comment How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?
Its ok @SamWhited, I now have some clarity on which way to proceed. I read up some good articles about PGP vs PKI, PKI and PGP in itself, and that helped. Thanks for chipping in.
Jun
13
comment How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?
I am indeed trying to keep myself from rolling anything of my own, but here's the thing if I go with certificates. The connections between the apps and other services(services other than CA) will not be SSL, so I'm not sure how will these certificates work there. Additionally, I want one request-response to do as much of the work as possible as low-latency is a design goal, and so would a certificate exchange take up one such full request-response?
Jun
13
comment How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?
First off, welcome to security.se. Altho am no old timer, still. Moving on, between SamWhited's and your answer, I guess I'm getting what is being told here. I may not use the entire certificate format, but what can happen on first contact between 2 entities is, they exchange their public keys, and the signatures signed by the CAs private key in 2 variables in a GET/POST request. Thanks for your response again. EDIT: I'm writing this after your edit, to address it. I also require the Web Services to verify the apps, so the apps also need a pair of keys with them.
Jun
13
comment How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?
Now that I have seen the PGP scheme, and if you have understood my use case, should I just use a keyserver(holding all validated public keys active on the network)? And then how different is this from PKI? I am more confused now.
Jun
12
awarded  Commentator
Jun
12
comment How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?
Thanks for the response. I would build apps for iOS/Android which would connect to my Web Server over HTTPS. Additionally, the apps would also connect to other Web Servers which would provide supplementary services. It is for this part that I am trying to implement a PKI, so that the apps can identify themselves to the supplementary Web Servers and vice versa. I also agree that generating Private key off-site is against the principle, but then how could I make sure that all public keys across the network are recognised as valid by my Web Server?
Jun
12
asked How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?
Feb
8
awarded  Scholar
Feb
8
awarded  Benefactor
Feb
8
accepted How to replace a constant identifier, for a resource on a network, with a variable one?
Feb
6
comment How to replace a constant identifier, for a resource on a network, with a variable one?
It does seem like the chances are bleak or else I would be on the verge of a major breakthrough and going nuts by now. BTW, I was looking at en.wikipedia.org/wiki/Zero-knowledge_proof but then implementing something usable enough on the Human-Machine Interface seems like a challenge(assuming the human brain to be far less likely to get compromised without being noticed).
Feb
3
revised How to harden an iPhone/Android app so its tough to reverse-engineer it?
added 219 characters in body
Feb
3
revised How to replace a constant identifier, for a resource on a network, with a variable one?
added 238 characters in body
Feb
2
comment How to harden an iPhone/Android app so its tough to reverse-engineer it?
@Ramhound Yes, it indeed is mighty tough limiting installation strictly to unrooted devices, but so far that seems like our second best bet.
Feb
2
comment How to replace a constant identifier, for a resource on a network, with a variable one?
You got it right. This much is clear after all the conversations on this page that I need to be looking for integrity verification. Now am finding how to fingerprint the execution of the client program or possibly tap into behavioral analysis from a remote site to effect what I want. Thanks for the hints.
Feb
2
awarded  Supporter
Feb
2
revised How to harden an iPhone/Android app so its tough to reverse-engineer it?
edited tags