Timeline for How can a server prove authenticity
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 13, 2016 at 23:39 | comment | added | Philipp | @SlavaKnyazev What I described in my post is a simplified version of TLS. A TLS connection begins with an asymmetric encrypted exchange of a symmetric key which is then used for the rest of the session. For details, please read the wikipedia article. | |
| May 13, 2016 at 23:36 | comment | added | Slava Knyazev | @Philipp Sorry if I mixing things up.. but isn't TLS asymmetric? I'm talking about symmetric encryption. | |
| May 13, 2016 at 23:33 | comment | added | Philipp | @SlavaKnyazev As I said, use TLS with certificate pinning. Any programming language which is widely used should have a free implementation. | |
| May 13, 2016 at 23:30 | vote | accept | Slava Knyazev | ||
| May 13, 2016 at 23:30 | comment | added | Slava Knyazev | Yes! This is exactly what I needed. I was looking more for a way to avoid MITM alltogether but with this method, it simply doesn't matter. Working on the idea a bit, which encryption would be best to use in this case? Ideally something that has libraries for most modern languages. | |
| May 13, 2016 at 23:21 | comment | added | Philipp | @zerkms According to the question, the clients already have the public key: "The server keeps a private key and makes the public key public which can then be installed into clients." If the clients would not have the public key and need to acquire it from an untrusted source, the solution would be to sign the public key by a trusted certificate authority (which is, again, something TLS has already invented). | |
| May 13, 2016 at 23:16 | history | edited | Philipp | CC BY-SA 3.0 |
added 152 characters in body
|
| May 13, 2016 at 23:14 | comment | added | zerkms | "An impostor server would not have the private key of the server" --- how does the client prove authenticity of the real application server public key? | |
| May 13, 2016 at 23:13 | history | edited | Philipp | CC BY-SA 3.0 |
added 152 characters in body
|
| May 13, 2016 at 23:12 | comment | added | zerkms | "encrypt it with the public key of the server" --- how would you obtain it? That's what OP is concerned about. | |
| May 13, 2016 at 23:08 | history | answered | Philipp | CC BY-SA 3.0 |