Skip to main content
6 events
when toggle format what by license comment
Mar 4, 2018 at 17:18 comment added korrigan @DavidThielen Finally, I don't know about your customers, but if they are secure labs and sensitive operations, they probably have requirements and policies w.r.t. cryptographic material, which would further influence your choice of implementation.
Mar 4, 2018 at 17:17 comment added korrigan @DavidThielen I note that you didn't mention that the server's response is encrypted. Although from your description, a lot of what you seem to need would probably be answered by TLS (e.g. via HTTPS). Do consider whether your licensing server would benefit from exposing a service via HTTPS (possibily requiring a client certificate for clients' authentication).
Mar 4, 2018 at 17:13 comment added korrigan Yes there is a significant downside, and you mentioned yourself: the key would just be a key, without any means of verifying its integrity and authenticity. Your library is responsible for verifying that the parameters of the communication channels it operates correspond to the specification -- in your case, if you need a trusted, secure and confidential channel, your library needs a way to authenticate the public key it is using before sending out encrypted information using that same key.
Mar 3, 2018 at 21:02 comment added David Thielen Is there any downside to having the public key as key=ABC... in the properties file (Java app) as opposed to a file. This loses the signed part of the public key, but is that critical? BTW - we have customers with no internet connection (highly secure government labs, nuclear power plants, etc)
Mar 3, 2018 at 21:00 vote accept David Thielen
Mar 3, 2018 at 12:03 history answered korrigan CC BY-SA 3.0