I have an object which I need to transmit to clients and I need the clients to know that I actually created the object. Obviously, this process involves in me signing the object with my private key, so the clients can then verify it using my public key. The only problem which I have is that there is some processing in yet another application which changes some properties inside this object. This means that I cannot sign the whole object since verification will fail. However, what I really need to verify is the Payload, which does not change. The process which I followed is the following. Please let me know if this is the correct way of doing it and point out any security flaws which there might be.
- I added 2 properties in the object (SignedPayload and PublicKey)
- Create a public/private key pair
- Signed the Payload using the private key, and set SignedPayload
- Added the public key to the PublicKey property
The middle application will now be hit, and some properties are going to change, but, the Payload will not. Ultimately, the next steps will be done once the message is received on the client:
- Deserialized the message
- Verify the message using the PublicKey, Payload and SignedPayload properties. If the Payload has changed, or the public key does not originate from my organization, the message is ignored. This means that I have to sign the public key.
My main questions are:
- Is this approach secure?
- How do I sign the public key so the client can make a check that I am the owner of the key?
- From what I have read, it is common practice to transmit the public key when signing and verifying data. Is this correct?
- Is there something wrong with the approach of creating a key pair for every message, since I am always transmitting the public key? The reason for this is to avoid having to store the private key on the server, which can be hijacked.
Many thanks in advance.