0

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the features such as file transfer, registering and logging in and so on (MySQL database keeping records of users and passwords) and so on. I've come to a halt in my development when trying to implement security features. I want to use asymmetric cryptography for authentication and symmetric cryptography for encrypting communication between client and server. So here is the deal:

The communication between client and server will be doing using AES. This relies on a pre-shared key between both parties. This pre-shared key will be generated on the client side each time a session is initiated and will be sent to the server, encrypted using the servers public key. That way, only the server that posses the private key will be able to decrypt the pre-shared key and read the communication. Where I am a bit confused is the sharing of the servers public key. Now I know the best way to do this is to use a digital certificate containing the servers public key. I also know this certificate should come from a trusted CA.

My question is, how do I go about getting a digital certificate for my server? Will my android application request for this certificate from the server or the CA? My initial thought is that it has to receive this certificate from a CA, as if it receives it from the server, it may be fraudulent. What is the process and the correct way of going about this? Anywhere I read, it just talks about HTTPS connection from client to Web server. I am writing a server in java that will communicate over sockets with my android application. How do I go about creating, receiving and verifying certificates in relation to trusted CAs?

Thanks

Improve this question
2
  • "This Preshared key will be generated on the client side each time a session is initiated and will be sent to the server, encrypted using the servers public key." - that's not a pre shared key then.
    – Tobi Nary
    Apr 7, 2016 at 15:07
  • My bad. I should have said a shared key
    – George Windonski
    Apr 7, 2016 at 15:18

1 Answer 1

Reset to default
0

You say:

My initial thought is that it has to receive this certificate from a CA, as if it receives it from the server, it may be fraudulent.

Yet, here lies the problem with your thinking: X.509 certificates are crafted such that they are tamper resistant. If the server changes the certificate, it get's invalid (with acceptable probabitity).

You can do it the same way TLS does it and let the server present the client the certificate to validate. Because it's signed by a CA the client trusts, it can be accepted.

Also, the usual disclaimer:

Why do you not use TLS? That's what it is for. Do now brew your own crypto.

Improve this answer
4
  • Aha, I see. So that means I will have to purchase? A certificate from a CA thay all my clients will trust? How do I know which CAs My clients will trust? I cannot use tls as this is an educational project
    – George Windonski
    Apr 7, 2016 at 15:17
  • iff this is solely an educational project, you may brew your own crypto. But yes, get a certificate from a trusted entity, have a look at lets encrypt for a free one. And read up some more on the public key infrastructure. And maybe TLS, that's what you want.
    – Tobi Nary
    Apr 7, 2016 at 15:21
  • Every example I have looked at and any tutorial I have read only talks about Web servers, as well as the 'lets encrypt' link you posted. Even though Im not implementing a Web server,will the digital certificate still be the same and work for what I am trying to do?
    – George Windonski
    Apr 7, 2016 at 15:30
  • What do you think "transport security layer" has to offer? That's the good thing about the ISO-OSI model. Neatly layered, reusable concepts.
    – Tobi Nary
    Apr 7, 2016 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .