1

I'm trying to implement a simple licensing system for my softwares and there's something I don't quite understand regarding certificates.

I'm using OpenSSL to generate a RSA private and public key. My executables will embed the public key in order to be able to negotiate a secure connection with the server (by exchanging a symmetric key). RSA is limited to the bytes of the key, therefore I will have to deal, for a 2048 key, to send a symmetric key of about 256 bytes (is this correct?)

What I don't understand is the role of certificates in this process.. do I need one? Examples like this one make use of certificates (either signed by a CA or not). Can't my application just connect to my server, send the RSA encrypted symmetric key and start exchanging data? What's the problem with my approach?

Improve this question
1
  • An RSA encrypted value (your symmetric key) is limited to the size of the RSA key minus some overhead depending on the padding scheme you use, today usually PKCS1-v1_5 or OAEP; for a 2048-bit RSA key, it is around 220 bytes or 1800 bits. Any symmetric scheme using a key over 512 bits was designed by a lunatic and should not be used.
    – dave_thompson_085
    Sep 22, 2016 at 7:09

1 Answer 1

Reset to default
1

What I don't understand is the role of certificates in this process..

you already answered your question:

Can't my application just connect to my server

only if your application would know that it is your server and not mine... Here is where certificates start to play a role. They are used to identify communication peers. Server identifies itself with server certificate and client identifies itself with client certificate (if necessary).

All certificates are very similar and you must be able to distinguish them before trusting them. This means that client application must use some logic to validate server certificate to determine whether it is the right and trusted one. There are various options, one of which includes Certificate Pinning. While it sounds as an easy solution, it has some serious issues when you have to replace server certificate, because of expiration or because of compromise.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .