Timeline for How do we change the public key in our commercial app?
Current License: CC BY-SA 3.0
6 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Mar 4, 2018 at 17:18 | comment | added | korrigan | @DavidThielen Finally, I don't know about your customers, but if they are secure labs and sensitive operations, they probably have requirements and policies w.r.t. cryptographic material, which would further influence your choice of implementation. | |
Mar 4, 2018 at 17:17 | comment | added | korrigan | @DavidThielen I note that you didn't mention that the server's response is encrypted. Although from your description, a lot of what you seem to need would probably be answered by TLS (e.g. via HTTPS). Do consider whether your licensing server would benefit from exposing a service via HTTPS (possibily requiring a client certificate for clients' authentication). | |
Mar 4, 2018 at 17:13 | comment | added | korrigan | Yes there is a significant downside, and you mentioned yourself: the key would just be a key, without any means of verifying its integrity and authenticity. Your library is responsible for verifying that the parameters of the communication channels it operates correspond to the specification -- in your case, if you need a trusted, secure and confidential channel, your library needs a way to authenticate the public key it is using before sending out encrypted information using that same key. | |
Mar 3, 2018 at 21:02 | comment | added | David Thielen | Is there any downside to having the public key as key=ABC... in the properties file (Java app) as opposed to a file. This loses the signed part of the public key, but is that critical? BTW - we have customers with no internet connection (highly secure government labs, nuclear power plants, etc) | |
Mar 3, 2018 at 21:00 | vote | accept | David Thielen | ||
Mar 3, 2018 at 12:03 | history | answered | korrigan | CC BY-SA 3.0 |