Diffie Hellman Key Exchange in a messaging application

Question

I'm currently a student that is trying to develop a messaging application on android using java that will implement diffie hellman key exchange in order to ensure that they both will be able to calculate a secret key to decrypt the content that are send within the text.

I have looked for various sources online, but I could not find a library or able to made my own diffie hellman key exchange occur within the app itself. Such as if I use mobile A to generate the key, how does mobile B receive that data and know that it is the public key? Also, once the public key is received, how does he generate his own private key based on the public key?

I have looked at the various sources such as https://stackoverflow.com/questions/34237971/conducting-diffie-hellman-between-java-and-crypto-c http://docstore.mik.ua/orelly/java-ent/security/ch13_07.htm http://www.java2s.com/Tutorial/Java/0490__Security/ImplementingtheDiffieHellmankeyexchange.htm

and many more, but it seems like the codes that they provide is more for running within the app where there are 2 users in the device, and not within the app, but 1 user per device.

Sorry for the trouble, thanks!

Answer 1

To get a good picture of the Diffie Hellman Key Exchange some diagramatic representations may be helpful.

The common approach for messaging applications on Android (or any other client devices) in Java (or any other language) is to utilize TLS usually in conjunction with HTTPS to authenticate, authorize, and securely communicate the plain text message through a secure stream containing the cipher text representations between peers.

The likelihood of implementing a secure homemade version of a Diffie Hellman Key Exchange without a few years of experience is small. One fact that may clarify the bigger picture is that security in private-public cryptography relies on Certificate Authority involvement as part of authentication. JSA (Java Security Architecture) gives you some options to employ all that between peers and in the absence of a web server, but at a higher level.

The relationship between the private and public key is designed such that the private key cannot practically be calculated from the public key, so don't bother trying to find a way to do that.

Another highly secure alternative would be to use a one time pad, which will probably not be practical for your application at all.

If both devices have the same secret (which was agreed upon in advance) you could simply use a symmetric algorithm on both peers, but it would require a strong password to be stored on both devices or remembered by both users.