2

I want to send my application to different servers/terminals with content integrity and confidentiality.
So, I need to some process to sign my code and application before sending it to servers and to ensure that the software comes from a trusted source and has not been altered.
What do you suggest? What are the most common practices?

For example, use a symmetric key to encrypt the code and a public key to protect the symmetric key and hash of package?

1

That is the basic idea, but you probably don't want to implement a custom solution. Depending on your operating system there is probably already a mechanism, for example Debian's SecureApt which leverages GPG.

https://wiki.debian.org/SecureApt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.