kumar

101 reputation

bio	website
	location
	age
visits	member for	1 year, 3 months
	seen	Apr 4 at 20:54
stats	profile views	5

	101 reputation	bio	website		visits	member for	1 year, 3 months
9 badges		location			seen	Apr 4 at 20:54

summary answers questions tags badges favorites bounties reputation activity

33 Actions

suggestions reviews revisions comments badges posts accepts all

Apr 3	awarded	Popular Question
Dec 18	awarded	Popular Question
Jun 13	comment	How to supply OpenSSL generated Private & Public Keys to iOS & Android apps? Its ok @SamWhited, I now have some clarity on which way to proceed. I read up some good articles about PGP vs PKI, PKI and PGP in itself, and that helped. Thanks for chipping in.
Jun 13	comment	How to supply OpenSSL generated Private & Public Keys to iOS & Android apps? I am indeed trying to keep myself from rolling anything of my own, but here's the thing if I go with certificates. The connections between the apps and other services(services other than CA) will not be SSL, so I'm not sure how will these certificates work there. Additionally, I want one request-response to do as much of the work as possible as low-latency is a design goal, and so would a certificate exchange take up one such full request-response?
Jun 13	comment	How to supply OpenSSL generated Private & Public Keys to iOS & Android apps? First off, welcome to security.se. Altho am no old timer, still. Moving on, between SamWhited's and your answer, I guess I'm getting what is being told here. I may not use the entire certificate format, but what can happen on first contact between 2 entities is, they exchange their public keys, and the signatures signed by the CAs private key in 2 variables in a GET/POST request. Thanks for your response again. EDIT: I'm writing this after your edit, to address it. I also require the Web Services to verify the apps, so the apps also need a pair of keys with them.
Jun 13	comment	How to supply OpenSSL generated Private & Public Keys to iOS & Android apps? Now that I have seen the PGP scheme, and if you have understood my use case, should I just use a keyserver(holding all validated public keys active on the network)? And then how different is this from PKI? I am more confused now.
Jun 12	awarded	Commentator
Jun 12	comment	How to supply OpenSSL generated Private & Public Keys to iOS & Android apps? Thanks for the response. I would build apps for iOS/Android which would connect to my Web Server over HTTPS. Additionally, the apps would also connect to other Web Servers which would provide supplementary services. It is for this part that I am trying to implement a PKI, so that the apps can identify themselves to the supplementary Web Servers and vice versa. I also agree that generating Private key off-site is against the principle, but then how could I make sure that all public keys across the network are recognised as valid by my Web Server?
Jun 12	asked	How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?
Feb 8	awarded	Scholar
Feb 8	awarded	Benefactor
Feb 8	accepted	How to replace a constant identifier, for a resource on a network, with a variable one?
Feb 6	comment	How to replace a constant identifier, for a resource on a network, with a variable one? It does seem like the chances are bleak or else I would be on the verge of a major breakthrough and going nuts by now. BTW, I was looking at en.wikipedia.org/wiki/Zero-knowledge_proof but then implementing something usable enough on the Human-Machine Interface seems like a challenge(assuming the human brain to be far less likely to get compromised without being noticed).
Feb 3	revised	How to harden an iPhone/Android app so its tough to reverse-engineer it? added 219 characters in body
Feb 3	revised	How to replace a constant identifier, for a resource on a network, with a variable one? added 238 characters in body
Feb 2	comment	How to harden an iPhone/Android app so its tough to reverse-engineer it? @Ramhound Yes, it indeed is mighty tough limiting installation strictly to unrooted devices, but so far that seems like our second best bet.
Feb 2	comment	How to replace a constant identifier, for a resource on a network, with a variable one? You got it right. This much is clear after all the conversations on this page that I need to be looking for integrity verification. Now am finding how to fingerprint the execution of the client program or possibly tap into behavioral analysis from a remote site to effect what I want. Thanks for the hints.
Feb 2	awarded	Supporter
Feb 2	revised	How to harden an iPhone/Android app so its tough to reverse-engineer it? edited tags
Feb 1	comment	How to replace a constant identifier, for a resource on a network, with a variable one? By authenticating a client to a server I mean, the server can unambiguously deduce that the client isn't compromised and that it can be trusted to be the only one in possession of its identifier. So any check/test which fails whenever an infected/zombie/impersonating client tries to connect to the server is good to go. I realise the answer am looking for is near-impossible, but I would like to persist for a little longer.