1

A little context: I'm working in designing a system to sign and verify data sent between modules of a bigger system. Currently the system has two parts, a central application and a SDK inside modules which is making all the key exchange and communication with the central server.

This are the relevant points so far:

  1. I generate a key pair for each module every day at a given time (lets say 12 am). This is done in a central application which has an HSM as the main key store
  2. I need to send the key pair to their owner along with the public keys of every other module in the system

I know that in cryptography is always better to use something existent than create your own approach so the questions are:

Is there any protocol, algorithm or standard for this centralized key exchange? How can I assure that all the modules had receive the public keys of the other modules?

Thank you, I hope I've been clear enough, English is not my native language

Improve this question
5
  • ... you shouldn't need to distribute all the public keys. You should be able to have a signing cert sign the keys, and the modules trust the signing key (which is how browsers work) - at which point the modules generate their own private keys, and the HSM signs the CSR.
    – Clockwork-Muse
    Commented Jul 30, 2021 at 6:16
  • If I don't distribute all public keys I have to send the public key with the information in order to verify the signatures right?
    – Aloxi
    Commented Aug 2, 2021 at 20:59
  • I was assuming that you were going to be doing mutual-auth SSL, where both parties have their own key for the encrypted live channel (as opposed to signed data at rest). In such a case, you just need to verify the certificate chain; that is, that the other party has a specific signing certificate in the chain. If you control that signing cert (which would live in the HSM), then verifying that it's in the chain verifies the id of the other party (since they're the only ones with the matching private key).
    – Clockwork-Muse
    Commented Aug 3, 2021 at 1:16
  • If you're dealing with signed data at rest, then yes, you need some way to get/distribute the signing keys, which may mean sending a copy of the key at that point, yes. Note that you still need to validate the cert chain if you don't use a limited certificate store, since otherwise a malicious party could use a different root/intermediate cert. But this is a somewhat rare need, because normally you're dealing with an ongoing channel with data in transit.
    – Clockwork-Muse
    Commented Aug 3, 2021 at 1:23
  • It is possible to do key exchange between three or more parties using traditional Diffie-Hellman. See en.wikipedia.org/wiki/… for more info.
    – mti2935
    Commented Apr 26, 2022 at 15:41

1 Answer 1

Reset to default
0

You should not need to generate a new keypair every day. You can generate one when the component is brought online, and keep it indefinitely.

You can use OpenSSL to generate a certificate, create a Certificate Signing Request (CSR), and have the central application sign it. Each module would keep his private key safe, and use it to sign the communication.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .